Unauthorized

4xx Client Error

Last updated: August 3, 2026

Authentication is required and has not been provided, or provided credentials are invalid.

Description

The name is misleading — 401 is about authentication, not authorization. It signals 'I don't know who you are, prove it'. Responses SHOULD include a WWW-Authenticate header describing the required auth scheme.

When to use

Return 401 when no Authorization header is provided, or when the token is missing / expired / malformed.

Common pitfalls

Do not use 401 for 'authenticated but not permitted' — that's 403.

Also searched as

Developers commonly search for 401 using phrases like 401 unauthorized · 401 error · http 401 · 401 vs 403 · 401 unauthorized meaning · 401 status code. All refer to the same HTTP 401 Unauthorized response.

Specification

RFC 9110 §15.5.2

Examples

HTTP response

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{"error":"Unauthorized"}

Node.js (Express)

res.status(401).json({ error: "Unauthorized" });

Go (net/http)

w.WriteHeader(http.StatusUnauthorized)

Python (Flask)

return jsonify({"error": "Unauthorized"}), 401

Debug 401 with these tools

JWT Decoder →Inspect the token your API is rejecting — check exp, aud, iss.JWT Verifier →Verify the signature against the expected public key.JWT Generator →Craft a fresh test token with the right claims.Base64 Encoder →Build a proper `Authorization: Basic user:pass` header value.

Related status codes

403

Forbidden

The server understood the request and the client is authenticated, but access is refused.