HTTP 401 Unauthorized

HTTP 401 Unauthorized — The request lacks valid authentication credentials; it must include a WWW-Authenticate challenge.

Class

4xx Client Error

Defined in

RFC 9110 §15.5.2

Official

Yes (IANA registry)

Cacheable by default

No (unless Cache-Control/Expires say so)

Safe to retry

Not without changing the request

What does HTTP 401 mean?

401 Unauthorized means the request has no valid authentication credentials for the target resource. Despite the name, it's about authentication (who are you?), not authorization (what may you do?) — that's 403.

The server must include a WWW-Authenticate header describing how to authenticate, e.g. Bearer for OAuth tokens or Basic for username/password. A Basic challenge makes browsers show their built-in login dialog.

When is 401 used?

• No Authorization header, session cookie or API key was sent.
• The token or session has expired or was revoked.
• The credentials are wrong (bad password, invalid signature on a JWT, wrong API key).

Common causes of a 401

• Your session timed out or you were logged out.
• An API key or access token is missing, mistyped, expired or for the wrong environment (test vs live).
• A proxy or CDN stripped the Authorization header (common with some redirects and misconfigured proxies).
• The client clock is off, so a fresh JWT looks expired or not yet valid.

How to fix 401 Unauthorized

If you're visiting the site

1. Sign in again; if you were signed in, sign out and back in to refresh your session.
2. Check the username and password; reset the password if needed.
3. Clear the site's cookies and make sure your browser accepts cookies from it.

If you run the site or API (developers)

1. Always send WWW-Authenticate with 401 (Bearer realm="api", error="invalid_token" for OAuth 2.0, RFC 6750).
2. Use 403, not 401, when the user is authenticated but lacks permission.
3. On the client, intercept 401s to refresh the access token once and retry, then redirect to login.
4. Avoid WWW-Authenticate: Basic on API routes called from the browser — it triggers the native login pop-up.

Returning or handling 401: server examples

location /admin/ {
    auth_basic "Admin area";
    auth_basic_user_file /etc/nginx/.htpasswd; # sends 401 + WWW-Authenticate: Basic
}

function requireAuth(req, res, next) {
  const token = req.get("authorization")?.replace(/^Bearer /, "");
  if (!token || !verify(token)) {
    return res.status(401)
      .set("WWW-Authenticate", 'Bearer realm="api", error="invalid_token"')
      .json({ error: "unauthorized" });
  }
  next();
}

// app/api/example/route.ts (Next.js App Router)
export async function GET(req: Request) {
  const session = await auth(req);
  if (!session) {
    return Response.json({ error: "unauthorized" }, {
      status: 401,
      headers: { "WWW-Authenticate": 'Bearer realm="api"' },
    });
  }
  return Response.json(await getData(session.userId));
}

Example 401 response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"
Content-Type: application/json

{"error":"unauthorized"}

Related status codes

• 403 ForbiddenThe server understood the request but refuses to authorize it.
• 407 Proxy Authentication RequiredLike 401, but the client must first authenticate with the proxy in between.
• 419 Page ExpiredLaravel's response when the CSRF token is missing or expired, usually after a session times out.

Related tools

• HTTP status codes — full list
• HTTP headers reference
• cURL converter
• Mock API — fake REST endpoints with custom status codes
• Webhook tester — inspect incoming requests