APITester| Status code | 401 |
|---|---|
| Status text | Unauthorized |
| Category | 4xx Client Error |
| Response has body | Usually |
| Specification | RFC 9110 |
What does 401 Unauthorized mean?
The request lacks valid authentication credentials. Despite the name, this means unauthenticated. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.
When do APIs return 401?
A missing, malformed, or expired Authorization header.
How to fix a 401 Unauthorized
Check the header is actually being sent and is correctly formed — Bearer <token> with a single space, no quotes around the token, no stray newline from copy-paste. Then check whether the token has expired: paste it into the JWT decoder to read its exp claim. Also confirm you are pointing at the right environment, since staging tokens do not work in production.
Reproduce a 401 response
The fastest way to understand a status code is to trigger one and read the full response. Open the
API tester and send a request to https://httpbin.org/status/401 — you will
see the 401 status along with every response header the server sent. Comparing those headers against
a working request is often what reveals the cause.
When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.
Related 4xx status codes
400 Bad Request
The server could not understand the request because it is malformed.
402 Payment Required
The request cannot be processed until payment is made.
403 Forbidden
The server understood the request and knows who you are, but refuses to authorise it.
404 Not Found
The server cannot find the requested resource.
405 Method Not Allowed
The endpoint exists but does not support the HTTP method you used.
406 Not Acceptable
The server cannot produce a response matching the client's Accept header.
401 Unauthorized FAQ
What is the difference between 401 and 403?
401 means the server does not know who you are: credentials are missing, expired or invalid. 403 means it knows who you are and the answer is still no. Re-authenticating can fix a 401 but not a 403.
Why do I get 401 with a valid token?
Common causes are an expired token, a token issued for a different environment or audience, a missing Bearer prefix, or the Authorization header being dropped by a redirect or proxy on the way.
What is the WWW-Authenticate header on a 401?
It tells the client how to authenticate: the scheme the server expects, such as Bearer or Basic, and sometimes an error code explaining why the credentials were rejected. A 401 response is required to include it.
See also
- 403 Forbidden — The server understood the request and knows who you are, but refuses to authorise it.
- 407 Proxy Authentication Required — A proxy between you and the server wants credentials before it will forward the request.
- Bearer tokens — How the token in an Authorization header works, and why it gets rejected.
- API authentication methods — Keys, tokens, Basic auth and OAuth compared.
References
- RFC 9110, 401 Unauthorized — The specification that defines this status code.
- MDN: 401 Unauthorized — MDN's reference page for this status code.