401 Unauthorized

What it means

Despite its name, 401 means unauthenticated. The server includes a WWW-Authenticate header describing how to authenticate.

Common causes

• Missing or expired login session or token.
• Wrong API key or password.

How to fix it

1. Sign in again or refresh the access token.
2. Check that the Authorization header is sent correctly.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"

Worked example

An API request omits its bearer token and receives 401. The client authenticates and retries with a valid token; if the credentials are already present, check whether they expired or were sent to the correct host.

How to read this response

1. Find the status line in your browser's Network panel, API client, or server access log.
2. Read the response body and headers shown above; headers such as Location, Allow, Retry-After, and WWW-Authenticate explain the next step.
3. Use the code's class to orient your diagnosis: informational, successful, redirected, request-related, or server-side.

SEO impact

Search engines cannot index pages behind a 401. Keep public content outside authentication.

How to check a status code

Enter a URL in the HTTP Status Checker to see its status code, every redirect hop, and response time. For redirect-heavy pages, the Website Speed Test shows how much time redirects add.

Frequently asked questions

What it means: HTTP 401

401 Unauthorized: The request needs valid authentication credentials.

Common causes: 401

Missing or expired login session or token. Wrong API key or password.

How to fix it: HTTP 401

Sign in again or refresh the access token. Check that the Authorization header is sent correctly.

Tools