An unauthenticated request to the bootstrapper endpoint is the first step for the OAuth2 flow from Office for iOS to your application.
Unauthenticated means no access token is attached in the Authorization HTTP header, or an expired or otherwise invalid token is attached.
The bootstrapper URL must be an HTTPS endpoint, and connections to the bootstrapper must be made using TLS.
The bootstrapper URL must be supplied as the BootstrapUrl property of the on-boarding information described in the section titled Onboarding information.
For full details, see the page Unauthenticated response.