401Unauthorized
401 Unauthorized means the request lacks valid authentication credentials. Despite the name, it is about authentication, not permission. The server must include a WWW-Authenticate header describing the challenge.
What does it mean?
The server can accept credentials but the request did not include them, or the ones it included were rejected. The client may retry with a new Authorization header.
If the client already tried and the same challenge comes back, the user agent should show the response body, which usually explains what went wrong.
When does it happen?
- A missing, expired, or malformed access token.
- A login form was submitted with the wrong password.
- An API key was omitted or sent under the wrong header.
How do you fix it?
If you run the server
- Send WWW-Authenticate with at least one challenge. A 401 without it is incomplete.
- Keep the error body short and useful; do not leak whether a username exists.
- Use 403 when the user is authenticated but not allowed to perform the action.
If you are just visiting
- Sign in again, or check that you are using the right account.
- If you are already signed in, clear the site session and retry.
