Developer
Encoders, converters & dev utilities
401 Unauthorized
HTTP 401 Unauthorized. Unauthenticated — the request lacks valid credentials (the name is misleading; it means authentication is missing or wrong, not authorization). Typically paired with a WWW-Authenticate header describing how to authenticate. When to use it: Return when the client must authenticate (or re-authenticate) to proceed; contrast with 403, where valid credentials still are not permitted. It is a client-error (4xx) status, which means the problem is with the request and the caller must change something before retrying. (Reference: RFC 9110 §15.5.2.)
Unauthenticated — the request lacks valid credentials (the name is misleading; it means authentication is missing or wrong, not authorization). Typically paired with a WWW-Authenticate header describing how to authenticate.
- When to use: Return when the client must authenticate (or re-authenticate) to proceed; contrast with 403, where valid credentials still are not permitted.
- How to handle: Send valid credentials (e.g. a correct Authorization header / token) as indicated by the WWW-Authenticate header.
- Reference: RFC 9110 §15.5.2
- Category: 4xx Client Error
Frequently asked questions
What does HTTP 401 mean?
HTTP 401 Unauthorized: Unauthenticated — the request lacks valid credentials (the name is misleading; it means authentication is missing or wrong, not authorization). Typically paired with a WWW-Authenticate header describing how to authenticate. It is a client-error (4xx) status, which means the problem is with the request and the caller must change something before retrying. It is defined in RFC 9110 §15.5.2.
What is the difference between 401 and 403?
401 Unauthorized really means "unauthenticated": the request lacks valid credentials, so the server does not know who you are — the fix is to send correct credentials, often guided by the WWW-Authenticate header. 403 Forbidden means you are authenticated (or auth is irrelevant) but not permitted, and re-sending credentials will not help. In short, 401 = "log in", 403 = "you are logged in but still can’t".