401 Unauthorized
Authentication is missing or failed. Sent with a WWW-Authenticate header saying how to authenticate. Despite the name, it means unauthenticated.
What to do
Send credentials, or fresh ones. The WWW-Authenticate header names the scheme the server wants. A missing or expired token is the usual cause. Valid credentials without permission get a 403 instead.
- Class
- 4xx Client Error. The request has a fault, or cannot be met as sent.
- Registered
- Yes, in the IANA HTTP status code registry.
- Cacheable by default
- No. A cache stores it only when Cache-Control or Expires says to.
- References
- RFC 9110 ยง15.5.2 · MDN
Example response
HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer realm="api"
Every 4xx code
- 400 Bad Request
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 407 Proxy Authentication Required
- 408 Request Timeout
- 409 Conflict
- 410 Gone
- 411 Length Required
- 412 Precondition Failed
- 413 Content Too Large
- 414 URI Too Long
- 415 Unsupported Media Type
- 416 Range Not Satisfiable
- 417 Expectation Failed
- 418 (Unused)
- 421 Misdirected Request
- 422 Unprocessable Content
- 423 Locked
- 424 Failed Dependency
- 425 Too Early
- 426 Upgrade Required
- 428 Precondition Required
- 429 Too Many Requests
- 431 Request Header Fields Too Large
- 444 (No name)
- 451 Unavailable For Legal Reasons
- 460 (No name)
- 463 (No name)
- 464 (No name)
- 494 Request Header Or Cookie Too Large
- 495 SSL Certificate Error
- 496 No Required SSL Certificate Was Sent
- 497 Plain HTTP Request Sent to HTTPS Port
- 499 Client Closed Request