401 Unauthorized: what it means and what to do
Despite the name, a 401 is not really about authorization. The official definition in RFC 9110 is that the request lacks valid authentication credentials for the target resource, meaning the server does not know who you are yet, or does not accept the proof you sent. The response must include a WWW-Authenticate header telling the client how to log in. Being forbidden, where the server knows you and still says no, is a different code, 403.
If you are just visiting a site
- Sign in, or sign in again. The most common 401 is an expired session. Sign out fully, then back in, and the fresh credentials usually clear it.
- Check the link. Links into account areas, order pages, or shared documents often carry a login requirement. If someone sent you the link, you may need to open it with the account it was shared with.
- Clear cached credentials. Browsers and apps sometimes keep sending an old password or an expired token. Clearing the site's cookies and stored passwords forces a clean login.
- Check the device clock. Time-based login tokens fail when a device clock is badly wrong, and some apps surface that failure as a 401.
If it is your site or your API
- Send the required header. A 401 without a WWW-Authenticate header is non-compliant and breaks login flows in browsers and clients.
- Check token expiry and signing keys. For token-based APIs, a rotated signing key or a clock skew between servers produces valid-looking logins that all fail as 401.
- Separate 401 from 403 in your code. No credentials or bad credentials is 401. Valid credentials with insufficient permission is 403. Mixing them up makes debugging miserable for your users.
- Look for proxy interference. Reverse proxies and corporate gateways sometimes strip the Authorization header, so the application sees anonymous requests.
Visitors: a 401 is a locked door asking for a key, not a sign your account was deleted. Owners: if legitimate users report 401s right after a deploy, suspect key rotation or header stripping before suspecting them.
Common questions
What is the difference between 401 and 403? A 401 means the server does not have valid proof of who you are, so logging in (or logging in again) can fix it. A 403 means the server knows who you are and is refusing anyway, so logging in again changes nothing.
Why am I getting a 401 when I am already logged in? Your stored credentials have usually expired or gone stale, a session token that timed out, a password that changed on another device, or a cookie your browser keeps sending after it stopped being valid. Signing out and back in replaces them.
Related errors