HTTP 401 Unauthorized
Authentication is required or has failed.
What HTTP 401 Unauthorized means
401 Unauthorized means authentication is required and either wasn't provided or failed. Despite the name it's really 'unauthenticated' — the server doesn't know who you are. The response should include a `WWW-Authenticate` header describing how to authenticate.
Which category is it?
401 is a 4xx code — Client error. 4xx means the request has a problem the client must fix — bad syntax, missing authentication, or a resource that isn't there. It's the caller's responsibility.
Common causes
- Missing `Authorization` header
- Expired or invalid token or credentials
- Wrong authentication scheme
How to fix it
- Send valid credentials or a fresh token
- Check the token hasn't expired (inspect its claims)
- Confirm the expected auth scheme (Bearer, Basic, etc.)
Example 401 response
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Content-Type: application/json
{"error":"token expired"}How to diagnose a 401
- Confirm the request actually carries credentials: an Authorization header, a session cookie or an API key in the expected place.
- Decode the token if it is a JWT and check its exp, nbf, aud and iss claims. Expired or wrong-audience tokens are the most common cause.
- Verify the scheme matches what the server expects (Bearer vs Basic vs an API key header) and that nothing, such as a proxy, strips the header.
- Read the WWW-Authenticate response header. It often names the scheme and an error code that explains the failure.
401 compared with similar codes
- 403: 401 means the server does not know who you are (authentication missing or invalid). 403 means it knows who you are but you are not permitted.
- 404: Some APIs return 404 instead of 403 to hide that a resource exists. A 401 always concerns credentials, never the resource.
401 Unauthorized: common questions
What is the difference between 401 and 403?
401 is about authentication: log in or send valid credentials. 403 is about authorization: you are logged in but lack permission, so authenticating again will not help.
Why do I get 401 with a valid-looking token?
Typical reasons are expiry, clock skew between systems, a token issued for a different audience or environment, or a proxy removing the Authorization header.