4xx Client Error
401 Unauthorized
The request lacks valid authentication credentials. Despite the name, it means "unauthenticated".
What causes it
- No `Authorization` header, or an expired token.
- A token signed with the wrong key, or for the wrong audience.
- Basic auth credentials that do not match.
How to fix it
- A 401 response must include a `WWW-Authenticate` header naming the scheme. Many APIs omit it, which is a spec violation.
- Refresh the token and retry once — but only once, or you will build a redirect loop.
- If you meant "you are logged in but not allowed", the correct status is 403.
At a glance
- Class
- 4xx Client Error
- Reference
- RFC 9110 §15.5.2
- Standardised
- Yes
- Retry the request?
- No — fix the request
Other 4xx client error codes
- 400 Bad Request
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 407 Proxy Authentication Required
- 408 Request Timeout
- 409 Conflict
- 410 Gone
- 411 Length Required
- 412 Precondition Failed
- 413 Content Too Large
- 414 URI Too Long
- 415 Unsupported Media Type
- 416 Range Not Satisfiable
- 417 Expectation Failed
- 418 I'm a teapot
- 421 Misdirected Request
- 422 Unprocessable Content
- 423 Locked
- 424 Failed Dependency
- 425 Too Early
- 426 Upgrade Required
- 428 Precondition Required
- 429 Too Many Requests
- 431 Request Header Fields Too Large
- 451 Unavailable For Legal Reasons
- 499 Client Closed Request