Server sends 401 Unauthorized header to indicate that authentication is required.
Credentials (username and password) passed with request
If credentials are valid (for some definition of valid) then the request is passed on to the next phase of the request handling (usually authorization).