401 Unauthorized

Authentication is required or the supplied credentials are invalid.

401 at a glance

Code: 401
Name: Unauthorized
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 9110, Section 15.5.2
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 401 means

401 Unauthorized really means "unauthenticated": the request lacks valid credentials for the target resource. The server must send a WWW-Authenticate header naming the scheme(s) it accepts (Basic, Bearer, Digest, Negotiate). If the user is authenticated but not allowed, the correct code is 403.

What typically causes a 401

Missing, expired or malformed Authorization header (e.g. an expired OAuth/JWT access token).
HTTP Basic auth on nginx (auth_basic) or Apache (AuthType Basic) protected paths; browsers show a login prompt.
API keys sent in the wrong header or query parameter.
Clock skew making signed tokens look expired or not yet valid.

Fix it on the server

Always include WWW-Authenticate, e.g. Bearer realm="api", error="invalid_token" (RFC 6750 error codes).
Do not return 401 for "logged in but forbidden": that is 403, and 401 makes clients retry login in loops.
If a reverse proxy strips the Authorization header (some PHP-FPM and CGI setups do), pass it explicitly.

Fix it as a client or visitor

Refresh the access token and retry once; if it still fails, re-authenticate.
Check the header format: Authorization: Bearer <token> with exactly one space and no quotes.
For Basic auth, credentials are base64 of user:password; curl does this with -u user:pass.

Headers that go with 401

Header	Role
`WWW-Authenticate`	Required: the challenge with scheme and realm.
`Authorization`	Request header carrying credentials.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"
Content-Type: application/json

{"error": "invalid_token"}