HTTP 401 — Unauthorized
4xx Client Error
What it means
Authentication is required and either missing or invalid. Despite the name, this is about authentication, not permission.
What to do about it
Check the Authorization header is present and correctly formatted, and that the token has not expired. The server should reply with a WWW-Authenticate header saying which scheme it expects.
Where it sits
401 belongs to the 4xx family: The request contains something the server will not or cannot process. The fix is normally on the client side.
HTTP/1.1 401 UnauthorizedChecking it yourself
# see the status code and headers only
curl -sI https://example.com/path
# follow redirects and print each hop
curl -sIL -o /dev/null -w "%{http_code} %{url_effective}\n" https://example.com/path
# JavaScript
const r = await fetch(url);
console.log(r.status, r.statusText);How this code behaves
| Cacheable by default | No — caches must not store this response unless explicit cache headers permit it. |
| Safe to retry | No. Retrying an identical request will produce the same result — the request itself must change. |
| Effect on search indexing | No direct effect. |
Returning 401 correctly
# nginx
return 401;
# Express
res.status(401).json({ error: 'Unauthorized' });
# Go
w.WriteHeader(401)
# Python (Flask)
return jsonify(error='Unauthorized'), 401;Frequently asked questions
What does HTTP 401 mean?
Authentication is required and either missing or invalid. Despite the name, this is about authentication, not permission.
How do I fix a 401 error?
Check the Authorization header is present and correctly formatted, and that the token has not expired. The server should reply with a WWW-Authenticate header saying which scheme it expects.
Is 401 a client or server problem?
A client problem by definition — the request needs to change. That said, a 4xx can still be the server’s fault if it is misconfigured and rejecting valid requests.