HTTP 401 Unauthorized

What it means

401 Unauthorized means the server needs you to authenticate and either no credentials were sent or the ones sent are invalid or expired. Browsers may show a login prompt; APIs return it when the token or API key is missing or wrong.

Applies to: All browsers, REST APIs, nginx, Apache, IIS

How to fix HTTP 401 Unauthorized

1. Log out and log back in to the site, then reload
2. Clear cookies for the site so a stale session is dropped
3. Check the URL; a link may point to a protected area you are not signed in to
4. API clients: confirm the 'Authorization' header is actually sent (inspect it in DevTools Network or with 'curl -v')
5. API clients: refresh or regenerate expired tokens and API keys and check clock drift if JWTs are rejected
6. Read the 'WWW-Authenticate' response header; it states the expected scheme (Basic, Bearer, Digest)
7. If you own the site: check that reverse proxies forward the Authorization header to the backend and that CORS preflight requests are not themselves being authenticated

Why it happens

RFC 9110 defines 401 as missing or invalid authentication credentials for the target resource. Expired sessions, dropped headers, wrong keys and clock skew on token validation cause most cases.

FAQ

Related errors