401 Unauthorized

What does 401 Unauthorized mean?

The request lacks valid authentication credentials. Despite the name, this means unauthenticated. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.

When do APIs return 401?

A missing, malformed, or expired Authorization header.

How to fix a 401 Unauthorized

Check the header is actually being sent and is correctly formed — Bearer <token> with a single space, no quotes around the token, no stray newline from copy-paste. Then check whether the token has expired: paste it into the JWT decoder to read its exp claim. Also confirm you are pointing at the right environment, since staging tokens do not work in production.

Reproduce a 401 response

The fastest way to understand a status code is to trigger one and read the full response. Open the API tester and send a request to https://httpbin.org/status/401 — you will see the 401 status along with every response header the server sent. Comparing those headers against a working request is often what reveals the cause.

When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.

Related 4xx status codes