HTTP 401 Unauthorized

What does HTTP 401 mean?

Authentication is required and has failed or not been provided. Despite the name, 401 means “unauthenticated”. The response must include a WWW-Authenticate header describing how to authenticate (for example Bearer or Basic). Use 403 when the user is known but not allowed.

4xx Client error: The request has a problem the client can fix: wrong URL, missing credentials, bad data or too many requests.

Common causes of a 401 error

• Missing, expired or malformed API token or session cookie.
• Wrong username/password for HTTP Basic auth.
• A staging site protected with a password.

How to fix 401 Unauthorized

• Log in again or refresh the access token.
• Check the Authorization header format, e.g. Bearer <token>.

401 and SEO

Search engines cannot index pages behind authentication. That is intended for private areas — make sure public pages never return 401.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"

How to return a 401 response

Node.js (Express)

res.status(401).json({ error: 'Unauthorized' });

PHP

http_response_code(401);

Python (Flask)

return {'error': 'Unauthorized'}, 401

Go (net/http)

w.WriteHeader(401)

nginx

return 401;

Related status codes

• 403 Forbidden — The server understood the request but refuses to authorize it.
• 400 Bad Request — The server cannot process the request because it is malformed.

Check which status code a URL returns with the HTTP header checker.