DevToolsmith

HTTP 401 Unauthorized

HTTP 401 Unauthorized means the request needs valid authentication credentials. The request contains an error or can’t be fulfilled. Retrying unchanged won’t help.

Class
4xx Client error
Standard
RFC 9110
Cacheable by default
No
Safe to retry
Only after getting new credentials, for example by refreshing an expired access token
Go constant
http.StatusUnauthorized

What HTTP 401 means

Despite the name, 401 is about authentication: the server doesn’t know who you are, because credentials are missing, expired or invalid. The response must include a WWW-Authenticate header describing how to authenticate. If you are logged in but not allowed, the right code is 403.

How to fix a 401 error

  • Check the header format: Authorization: Bearer <token>, with a single space and no quotes.
  • Decode the JWT and check exp: expired tokens are the most common cause.
  • Behind a proxy or CDN, make sure the Authorization header is forwarded.

Retrying

Only after getting new credentials, for example by refreshing an expired access token.

Example response

HTTP/1.1 401 Unauthorized
Date: Wed, 21 Oct 2026 10:30:00 GMT
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Content-Type: application/json

How to return 401

Node.js (Express)
res.status(401).json({ error: 'Unauthorized' });
Python (FastAPI)
from fastapi import HTTPException

raise HTTPException(status_code=401, detail="Unauthorized")
Go (net/http)
http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
nginx
location /private/ {
    return 401;
}

Related status codes

Other 4xx status codes

400 Bad Request · 402 Payment Required · 403 Forbidden · 404 Not Found · 405 Method Not Allowed · 406 Not Acceptable · 407 Proxy Authentication Required · 408 Request Timeout · 409 Conflict · 410 Gone · 411 Length Required · 412 Precondition Failed · 413 Content Too Large · 414 URI Too Long · 415 Unsupported Media Type · 416 Range Not Satisfiable · 417 Expectation Failed · 418 I’m a Teapot · 421 Misdirected Request · 422 Unprocessable Content · 423 Locked · 424 Failed Dependency · 425 Too Early · 426 Upgrade Required · 428 Precondition Required · 429 Too Many Requests · 431 Request Header Fields Too Large · 444 No Response · 451 Unavailable For Legal Reasons · 499 Client Closed Request

See the full list of HTTP status codes.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does HTTP 401 Unauthorized mean?

HTTP 401 Unauthorized means the request needs valid authentication credentials. Despite the name, 401 is about authentication: the server doesn’t know who you are, because credentials are missing, expired or invalid. The response must include a WWW-Authenticate header describing how to authenticate. If you are logged in but not allowed, the right code is 403.

How do I fix HTTP 401?

Check the header format: Authorization: Bearer <token>, with a single space and no quotes. Decode the JWT and check exp: expired tokens are the most common cause. Behind a proxy or CDN, make sure the Authorization header is forwarded.