HTTP 401 Unauthorized

Authentication is missing or invalid. Despite the name, this is about identity, not permission — the server does not know who you are.

Defined in RFC 9110 §15.5.2 — 401 Unauthorized · MDN reference

Where you meet HTTP 401 in production

A missing Authorization header, an expired access token, a signature that does not verify, a session that has been revoked.

Why you would test it

Test the missing-header case and the invalid-token case separately. They are different bugs and they fail in different places.

What your client should do about a 401

A 401 means "authenticate and try again" — refresh the token once and retry, then stop. A refresh loop that never gives up is how a single expired credential becomes a sustained load spike. A compliant server sends a WWW-Authenticate header telling you which scheme it wants.

401 versus the codes it gets confused with

Endpoints that return 401

88 endpoints in this playground answer with 401. Every one is free, needs no signup, and can be called from the browser or with curl.

…and 63 more endpoints across the catalog.

Questions about HTTP 401

Why is it called Unauthorized when it means unauthenticated?
A naming mistake in the original specification that is now permanent. Read 401 as "unauthenticated".
Should I retry after a 401?
Once, after refreshing the credential. If the refreshed credential is also rejected, the problem is not transient.

Other client error codes

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated