Yes, I was trying various combinations of the following, with no success.

location @grpc_auth_fail {
add_trailer grpc-status 16 always;
add_header grpc-status 16 always;
add_trailer grpc-message Unauthorized always;
add_header grpc-message Unauthorized always;
return 401;
#return 200;
}


The choice of 16 for the status was based on this documentation (which is similar to the one you linked):
https://grpc.github.io/grpc/core/md_doc_statuscodes.html