401 error (Unauthorized)

The 401 error (Unauthorized) is an HTTP status code telling the client that a request was not fulfilled because the resource requires authentication and no valid credentials were provided. Despite the literal name, the code is really about authentication rather than authorization — the server simply does not know who is asking.

How the 401 error works

The standard flow looks like this: the client requests a protected resource without credentials, the server responds with 401 and a WWW-Authenticate header naming the expected scheme (Basic, Bearer, Digest), and the client retries with an Authorization header attached. In API traffic the usual culprits are an expired or malformed JWT, a wrong API key, or a missing Authorization header altogether. On traditional websites, 401 responses typically come from directory protection with Basic Auth (.htpasswd files) or from an expired user session that the application maps to this status.

Practical applications

Troubleshooting starts with the credentials themselves: verify the username and password, check the token's expiry claim and confirm it is sent in the right header and format. Next, review the server-side Basic Auth configuration, clear browser cookies and cache, and make sure the endpoint does not expect a different mechanism — an OAuth bearer token instead of a static key, for instance. From a security standpoint, a burst of 401 responses in the access log is a valuable signal: it often marks a brute-force attempt against a login endpoint, best contained with fail2ban-style banning or rate limiting. The neighboring status is worth knowing too — see 403 error, where the server knows the client but refuses access regardless.