Unauthorized
The request has not been applied because it lacks valid authentication credentials for the target resource.
Root Cause
Missing or invalid Authorization header, expired JWT, or incorrect API key.
How to Fix
Verify your credentials, check the expiry of your token using the JWT Decoder, and ensure the 'Authorization' header uses the correct scheme (e.g., 'Bearer').
Quick Summary
401 Unauthorized means the request is missing or carries invalid authentication credentials. Despite the name, it's about authentication, for permission denials of an authenticated user, return 403.
Key Takeaways
- 401 = caller is not authenticated (no creds, expired token, wrong scheme)
- 403 = caller is authenticated but not permitted to access the resource
- Always include `WWW-Authenticate: Bearer realm="…"` on a 401, RFC 7235 requires it
- Never reveal whether a username exists in a login response, return 401 with a generic message
When to use it
- Missing Authorization header on a protected endpoint
- JWT past its `exp` claim
- API key revoked or never issued
Common Mistakes
- Returning 401 when the user is authenticated but lacks a scope, should be 403
- Returning a 401 from a CORS preflight (browsers will mask the real error)
- Forgetting to set WWW-Authenticate, RFC-compliant clients will not surface the error correctly
401 Unauthorized, Frequently Asked
401 vs 403, which is which?
401: you have not proven who you are (no creds or bad creds). 403: we know who you are, you're just not allowed.
Should I distinguish 'expired token' from 'invalid token' in the response?
Use the `error` field in the WWW-Authenticate header: `Bearer error="invalid_token", error_description="The access token expired"` (RFC 6750).
Still having issues?
Check your network logs or use our developer tools to inspect headers, decode tokens, or validate your requests.