HTTP
HTTP 401Unauthorized
HTTP 401 Unauthorized means the request needs valid authentication and either had none or had credentials the server rejected. The response must include a WWW-Authenticate header describing how to authenticate. Despite the name, it is about authentication (who you are), not authorisation; a correctly authenticated user who is not allowed gets 403.
What 401 means
The resource requires authentication, and the request did not carry credentials the server accepts. The server tells the client how to authenticate with a challenge:
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"Authentication schemes
| Scheme | How credentials are sent | Notes |
|---|---|---|
| Basic | Authorization: Basic base64(user:password) | Only safe over HTTPS; the encoding is not encryption (decode it) |
| Bearer | Authorization: Bearer <token> | OAuth 2.0 and JWT APIs |
| Digest | Challenge-response hash | Rare today |
| Negotiate | Kerberos/NTLM | Windows integrated authentication, port 88 |
| Cookie-based sessions | Cookie: session=… | Not an HTTP auth scheme; apps often return 302 to login rather than 401 |
Common causes
- No credentials sent at all (anonymous request to a protected endpoint).
- Expired or revoked token; refresh it or log in again.
- Token sent in the wrong place (query string instead of header) or with the wrong scheme name.
- Clock skew making a JWT appear "not yet valid" or "expired" (see NTP).
- Cookies blocked by browser privacy settings or
SameSiterules on cross-site requests. - CORS preflight (OPTIONS) hitting an endpoint that demands auth; preflights carry no credentials.
Debugging with curl
curl -i https://api.example.com/me
curl -i -H "Authorization: Bearer YOUR_TOKEN" https://api.example.com/meThe first should return 401 with a WWW-Authenticate header; the second should return 200. If the second still fails, read the error parameters in the challenge. The authentication basics record explains the underlying concepts.
Frequently asked questions
Why do I get 401 after logging in?
The session cookie or token is not being sent (wrong domain or path, blocked third-party cookies, SameSite rules), or it has expired. Check the request headers in the browser developer tools for the Cookie or Authorization header.
What is the difference between 401 and 403?
401: the server does not know who you are, or your credentials are invalid; authenticating may help. 403: the server knows who you are and you are not allowed; authenticating again will not help.
Why does the browser show a login popup?
The server sent WWW-Authenticate: Basic, and browsers handle Basic and Digest challenges with a native dialog. Applications using cookies or tokens usually send a 302 to a login page instead, or a 401 with a Bearer challenge that the front-end handles.