Authentication is missing or invalid.
When to use it
No token, or an expired one. Despite the name, it means “unauthenticated”.
Common causes and fixes
Usual causes: no Authorization header, a malformed one such as a token without the Bearer prefix, an expired access token, a token issued for another environment or audience, or clock skew that makes a JWT look expired or not yet valid. Decode the JWT and check exp, nbf, aud and iss. A correct 401 includes WWW-Authenticate, naming the scheme the server expects.
Clients should refresh the token once and retry, not loop. Headers get lost on the way: browsers and curl drop Authorization on redirects to another host, and Apache with PHP-FPM or CGI strips it unless CGIPassAuth On is set. If a CORS preflight fails with 401, your server demands auth on OPTIONS; preflights never carry credentials, so let them through. Use 403 when the user is known but lacks permission.
Client error (4xx)
4xx codes are client errors: the request itself is wrong, unauthorised or points at something that isn’t there. Retrying the same request won’t help.
What it looks like
HTTP/1.1 401 UnauthorizedHow to send it
| Node.js / Express | res.status(401).end() |
|---|---|
| Python / Flask | return '', 401 |
| nginx | return 401; |
How to check it
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/