DELETE on the endpoint is accepted and acknowledged so well-behaved clients can run their cleanup step.
Authenticating
Both credential types work:401 with an RFC 9728 WWW-Authenticate challenge naming the protected-resource metadata document, so a spec-compliant MCP client can discover the authorization server and complete the OAuth flow on its own: