---
title: "401 Unauthorized — what it means and how to fix it"
description: "You need to authenticate, and either you did not or your credentials were rejected. What causes an HTTP 401, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/401/
site: "At One Place"
---

# HTTP 401 — Unauthorized

**HTTP 401: Unauthorized**

You need to authenticate, and either you did not or your credentials were rejected.

## What 401 actually means

Despite the name, 401 means unauthenticated, not unauthorised. The server does not know who you are, or does not accept the credentials you offered. The response is required to carry a `WWW-Authenticate` header naming the scheme it expects — Basic, Bearer, Negotiate — which is what makes a browser pop up a username-and-password box. The distinction from 403 is the useful part: 401 says "log in", 403 says "logging in will not help".

## Common causes

- No `Authorization` header was sent
- An API token or session has expired
- Wrong username or password
- A bearer token was signed with the wrong key, or its issuer/audience claims do not match
- The clock on the client is skewed enough to make a token look not-yet-valid or expired

## If you're just trying to view the page

1. Sign in again — the most common cause is simply an expired session
2. Check the username and password, including caps lock and leading or trailing spaces
3. Clear that site's cookies to drop a stale session, then log in fresh
4. If your organisation uses single sign-on, sign out of the identity provider entirely and start again

## If it's your site

1. Always send a `WWW-Authenticate` header; a 401 without one is technically invalid and breaks clients that try to respond to the challenge
2. Distinguish expired-token from invalid-token in the error body so clients know whether to refresh or re-prompt
3. Check clock skew between token issuer and verifier — a minute of drift will invalidate JWTs
4. Verify the token audience, issuer and signing key match what you expect; misconfigured `aud` claims are a frequent cause
5. Confirm proxies are forwarding the `Authorization` header — some strip it by default on redirects and cross-origin hops

## Reference

- **Status code:** 401
- **Reason phrase:** Unauthorized
- **Category:** 4xx — Client Error
- **Defined in:** RFC 9110 §15.5.2

## Common questions

### What does HTTP 401 mean?

You need to authenticate, and either you did not or your credentials were rejected. Despite the name, 401 means unauthenticated, not unauthorised. The server does not know who you are, or does not accept the credentials you offered.

### How do I fix a 401 error?

Sign in again — the most common cause is simply an expired session

### Is 401 a client error or a server error?

401 is in the 4xx range, which means client error. The request itself was the problem, so retrying it unchanged will usually return the same code.

## Related pages

- [404 Not Found](https://atoneplace.net/error/404/)
- [403 Forbidden](https://atoneplace.net/error/403/)
- [429 Too Many Requests](https://atoneplace.net/error/429/)
- [400 Bad Request](https://atoneplace.net/error/400/)
- [413 Content Too Large](https://atoneplace.net/error/413/)
- [422 Unprocessable Content](https://atoneplace.net/error/422/)
- [405 Method Not Allowed](https://atoneplace.net/error/405/)
- [409 Conflict](https://atoneplace.net/error/409/)
- [415 Unsupported Media Type](https://atoneplace.net/error/415/)
- [408 Request Timeout](https://atoneplace.net/error/408/)
- [410 Gone](https://atoneplace.net/error/410/)
- [451 Unavailable For Legal Reasons](https://atoneplace.net/error/451/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)