401
Client Error
401 Unauthorized: Authentication Required
✦ The Golden Answer: The 401 Unauthorized status code means that the request requires authentication and the client has not provided valid credentials. The server will include a
WWW-Authenticate header specifying the authentication scheme (e.g., Basic, Bearer, Digest). The client must resend the request with proper credentials. This is different from 403 Forbidden, which means the client is authenticated but not allowed to access the resource.
How 401 Works
- Client sends a request without authentication.
- Server responds with 401 Unauthorized and a
WWW-Authenticateheader indicating the required authentication scheme. - Client sends a new request with the appropriate credentials (e.g., Authorization header).
- If credentials are valid, server responds with the requested resource (200 OK or other success code).
Example: Basic Authentication
| Step | Direction | HTTP Message |
|---|---|---|
| 1 | Client → Server | GET /api/profile HTTP/1.1 |
| 2 | Server → Client | HTTP/1.1 401 Unauthorized |
| 3 | Client → Server | GET /api/profile HTTP/1.1 |
| 4 | Server → Client | HTTP/1.1 200 OK |
Common Authentication Schemes
- Basic – sends username and password encoded in Base64. Simple but insecure without HTTPS.
- Bearer – uses a token (e.g., JWT) in the Authorization header:
Authorization: Bearer <token>. - Digest – more secure than Basic, uses a challenge‑response mechanism.
- Negotiate – used for Kerberos/SPNEGO (common in enterprise environments).
- API Key – often passed as a query parameter or header (not a standard WWW‑Authenticate scheme, but common).
401 vs. 403: Key Differences
| Status | Meaning | Authentication Provided? | Action |
|---|---|---|---|
| 401 Unauthorized | Authentication missing or invalid. | ❌ No / invalid | Client should authenticate and retry. |
| 403 Forbidden | Authenticated but not allowed. | ✅ Yes (valid) | Client cannot access; no retry will help. |
How to Fix 401 Errors
- If you are a user: Check your username/password, token, or API key. Make sure you are logged in and have the correct permissions.
- If you are a developer: Check your authentication logic. Ensure you are sending the correct
Authorizationheader. For token‑based auth, verify the token is not expired. - If you control the server: Verify the
WWW-Authenticateheader is correctly formatted. Ensure the authentication backend (database, LDAP, etc.) is working.
Frequently Asked Questions
Is 401 Unauthorized the same as "not logged in"?
Yes, in practice, 401 means the client is not authenticated (or authentication failed). If the client is logged in but doesn't have permission, the correct code is 403 Forbidden.
Can 401 be cached?
Typically no, because authentication state is client‑specific. Caching 401 responses could cause issues for other clients. Most servers send Cache-Control: no-store for 401 responses.
What is the WWW-Authenticate header?
It's a response header that tells the client which authentication scheme to use. For example, WWW-Authenticate: Basic realm="My Site" indicates the client should use Basic authentication with the specified realm.