HTTP 401 Unauthorized — Meaning, Causes & How to Fix

Code

401

Name

Unauthorized

Class

4xx Client Error

Specification

RFC 9110 §15.5.2

Cacheable by default

Only with explicit Cache-Control / Expires

What HTTP 401 means

401 Unauthorized really means unauthenticated: the request lacks valid credentials. The server must include a WWW-Authenticate header saying how to authenticate. Sending the right credentials could make the same request succeed.

Common causes

• No token, cookie or API key was sent.
• The token or session expired.
• Wrong username/password in HTTP Basic auth.
• The Authorization header is stripped by a proxy.

How to fix it

For site owners

• Send a WWW-Authenticate header with every 401.
• Use 403, not 401, when the user is logged in but not allowed.

For visitors & developers

• Log in again or refresh your access token.
• Check the header format, e.g. Authorization: Bearer <token>.

SEO impact

Content behind a 401 cannot be crawled or indexed. Do not put pages you want ranked behind authentication; staging sites protected by 401 stay out of search results, which is usually the intent.

Example 401 response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Content-Type: application/json

{"error":"token_expired"}

Related status codes

Check or look up another code

Search and filter every code in the HTTP Status Codes tool, browse the full list by class, or read HTTP status codes explained: the complete developer guide.