diff --git a/src/OAuth2/Response/AuthenticationError.php b/src/OAuth2/Response/AuthenticationError.php
index <HASH>..<HASH> 100644
--- a/src/OAuth2/Response/AuthenticationError.php
+++ b/src/OAuth2/Response/AuthenticationError.php
@@ -8,9 +8,9 @@ class OAuth2_Response_AuthenticationError extends OAuth2_Response_Error
     public function __construct($statusCode, $error, $errorDescription, $tokenType, $realm, $scope = null)
     {
         parent::__construct($statusCode, $error, $errorDescription);
-        $authHeader = sprintf('%s realm=%s', $tokenType, $realm);
+        $authHeader = sprintf('%s realm="%s"', $tokenType, $realm);
         if ($scope) {
-            $authHeader = sprintf('%s, scope=%s', $authHeader, $scope);
+            $authHeader = sprintf('%s, scope="%s"', $authHeader, $scope);
         }
         $this->setHttpHeader('WWW-Authenticate', $authHeader);
     }
Place the realm & scope values in ""

- On Android, the lack of "" caused the Java to throw exceptions when
trying to read the response code (Android assumes that when we have a
response code like <I> we have the WWW-Authenticate header set) ... also
... it seems that Android is very particlular about the ""
- Most examples from the specs have the values of realm in "" i.e.
- - <URL>