401 Unauthorized — What It Means and How to Fix It

What 401 means

Despite the name, 401 means unauthenticated rather than unauthorised. The server does not know who you are. It should return a WWW-Authenticate header describing how to authenticate — and when it does not, that omission is itself a bug worth fixing.

Common causes

•No Authorization header sent at all.
•An expired token — the single most common cause in practice.
•A token signed with a key the server no longer trusts after a rotation.
•The wrong authentication scheme, such as Basic where Bearer is expected.
•Clock skew between services causing a valid JWT to look expired.

How to fix it

Decode the token and check its expiry claim before anything else. If it is valid, confirm the server is verifying against the current signing key — key rotation without a grace period produces exactly this failure, all at once, for everybody.

Catching 401 before your users report it

If an authenticated monitor starts returning 401 on a schedule, the cause is almost always a credential with an expiry nobody tracked. Monitor the token's expiry, not just the endpoint.

Monitor for 401 responses free

Often confused with

403 Forbidden

← All HTTP status codes

401 Unauthorized — questions

What is the difference between 401 and 403?

401 means the server does not know who you are — authenticate and try again. 403 means it knows exactly who you are and you still may not do this. Retrying with the same credentials fixes a 401 and never fixes a 403.

Why do I get 401 with a valid token?

Usually clock skew or key rotation. If the server's clock is ahead of the issuer's, a freshly issued token can appear to be issued in the future or already expired. Check NTP sync on both.

401