Skip to main content
protocols.page
401

Unauthorized

Active
RFC 9110 §15.5.2•Since 1996•APIs, authenticated endpoints

HTTP 401 Unauthorized indicates the request lacks valid authentication credentials for the target resource. Defined in RFC 9110 §15.5.2. The response must include a WWW-Authenticate header indicating the authentication scheme.

Description

The 401 Unauthorized status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The server MUST send a WWW-Authenticate header field containing at least one challenge.

Note: Despite its name, 401 is about *authentication* (who you are), not *authorization* (what you're allowed to do). For the latter, see 403.

Examples

Request without credentials
http
GET /api/account HTTP/1.1
Host: api.example.com
401 with challenge
http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"
Content-Type: application/json

{"error": "unauthorized", "message": "Valid authentication token required"}

Edge Cases

  • •MUST include WWW-Authenticate header — without it, clients can't know how to authenticate.
  • •401 means 'not authenticated' not 'not authorized'. The naming is a historical mistake.
  • •Token expiration should return 401, prompting the client to refresh and retry.

When You'll See This

  • →Missing or expired authentication token
  • →Invalid API key
  • →Session expired
  • →Basic auth credentials rejected

Implementation References

LanguageConstant
Gohttp.StatusUnauthorized
Rusthttp::StatusCode::UNAUTHORIZED
Pythonhttp.HTTPStatus.UNAUTHORIZED
Node.jshttp.STATUS_CODES[401]
.NETHttpStatusCode.Unauthorized
JavaHttpURLConnection.HTTP_UNAUTHORIZED

History

Introduced in HTTP/1.0 (RFC 1945, 1996). Originally designed for HTTP Basic/Digest authentication. Now widely used with Bearer tokens (OAuth 2.0).

Related Status Codes

403 Forbidden407 Proxy Auth Required

Related Headers

WWW-AuthenticateAuthorization

FAQ

What is the difference between 401 and 403?

401 means you're not authenticated (not logged in or token expired). 403 means you're authenticated but don't have permission.

Why is it called 'Unauthorized' if it means unauthenticated?

It's a historical naming mistake. 401 actually means 'unauthenticated'. 403 Forbidden is about authorization.

Source: RFC 9110 §15.5.2