loot.tools
401

Unauthorized

4xx Client Error

Authentication is required and has failed or not been provided.

401 Unauthorized actually means 'unauthenticated': the server doesn't know who you are. Either you sent no credentials or the ones you sent are wrong or expired. It's different from 403, where the server knows who you are but won't let you in. A correct 401 response includes a WWW-Authenticate header describing how to authenticate.

What 401 looks like on the wire

GET /api/me HTTP/1.1
Host: api.example.com

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"

About 4xx Client Error

The request has a problem the client needs to fix, like a bad URL, missing auth, or invalid input.

How to fix 401 Unauthorized

  • Send credentials - an Authorization header, token, or session cookie.
  • Check that the token hasn't expired and is for the right environment.
  • Confirm the auth scheme matches (Bearer vs Basic vs API key).
  • If credentials look right but still fail, regenerate the token or key.

Tools that help with 401

JWT Encoder/Decoder
Paste the Bearer token to see its claims and whether it's already expired, without another round trip to the server.
Encoder / Decoder
Decode the Basic auth header's base64 to confirm which username and password actually went over the wire.

Where it's defined

401 Unauthorized is defined in RFC 9110 §15.5.2. MDN's 401 reference covers browser behavior and examples.

Looking for a different one? See the full HTTP status code reference.