HTTP status · 4xx — client error
401 Unauthorized
401 Unauthorized means the request lacks valid authentication credentials for the target resource.
Key facts
| Class | 4xx — client error |
|---|---|
| Standard | RFC 9110 §15.5.2 |
| Required header | WWW-Authenticate |
| Cacheable by default | No |
| Fix side | Supply or refresh credentials |
What 401 means
The server needs authentication and the request did not carry acceptable credentials — no token, an expired token, or a token for the wrong realm. The response must include WWW-Authenticate describing the challenge so the client knows what to send.
401 versus 403
401 is about identity: the server does not know who you are. 403 is about permission: it knows who you are and refuses anyway. Re-sending the same credentials cannot fix a 403. In APIs, a missing or expired bearer token is the usual 401; a valid token without the required scope is usually 403.
Frequently asked questions
Does 401 mean the password is wrong?
It means the credentials were missing or not accepted. That can be a wrong password, an expired token, or a credential for a different realm.
Why does my API return 401 after login?
The request is probably not sending the token, sending it in the wrong header, or using an expired token. Check the Authorization header and its scheme.