401 Status Code: What It Means and How to Fix It

HTTP status code 401 means Unauthorized: the server received the request, understood it, and refused to fulfil it because valid authentication credentials were not supplied. In plain language, a 401 status code says the server does not know who you are, or no longer accepts the sign-in you presented.

Most 401 errors on ordinary websites are fixed by signing in again with the right account, or by clearing a stale session that the server no longer trusts.

What does HTTP status code 401 actually mean?

A status code is the three-digit number a web server sends back with every response to say how the request went. Codes in the four hundreds mean the server is blaming the request rather than itself. The 401 code is the specific one for authentication: the request needs credentials, and the credentials were absent, malformed, expired, or rejected.

Authentication means proving identity, usually with a username and password, a token, or an API key. It is not the same as authorization, which means having permission once identity is known. That distinction explains the name confusion: the code is called Unauthorized, but it is really about authentication.

A correctly built server that returns 401 also sends a WWW-Authenticate header, which names the authentication scheme it expects, such as Basic or Bearer. If you are debugging, read that header first: it tells you exactly what kind of credential the server wants.

What is the difference between a 401 and a 403 status code?

The 401 status code means the server does not know who you are, so identify yourself and try again. The 403 status code, Forbidden, means the server knows who you are and still refuses, so trying again with the same account will not help.

A practical test: if signing in changes the outcome, the correct code is 401. If the same signed-in user will always be refused, the correct code is 403. In real deployments the two are frequently mixed up, so treat the code as a strong hint rather than proof.

Why am I seeing a 401 error on a website?

For a person browsing normally, a 401 status code usually comes from one of a small number of causes.

• The sign-in session expired, often after a period of inactivity or after a password change.
• The password or username is wrong, including an old password saved by the browser and filled in automatically.
• Cookies are blocked, cleared, or corrupted, so the site cannot see the session it created for you.
• You are on a page that belongs to another account, or to a part of the site your account was never signed into.
• A browser extension, privacy tool, VPN, or corporate network is stripping or altering the request.
• The device clock is badly wrong, which breaks tokens that carry an expiry time.
• The site is protected by a separate password prompt at the server level, and the prompt was cancelled.

How do you fix a 401 status code as a visitor?

1. Reload the page once. A single expired request sometimes recovers on its own.
2. Sign out of the site fully, then sign in again, typing the password rather than accepting the saved one.
3. If sign-in fails, use the site's password reset flow rather than guessing repeatedly, since repeated failures can lock the account.
4. Open the same page in a private or incognito window. If it works there, the problem is a cookie or an extension in your normal window.
5. Clear cookies for that one site, not for everything, then sign in again.
6. Turn off browser extensions one at a time, especially ad blockers, script blockers, and privacy proxies.
7. Turn off a VPN or switch networks, then retry. Some sites refuse credentials arriving from unexpected networks.
8. Check that the device date, time, and time zone are set automatically and are correct.
9. Try a different browser or a different device to see whether the fault follows you.

If the error appears for everyone and not just you, nothing on your device will fix it, and the site's own operators have to act.

How do developers fix a 401 status code on an API?

When your own code receives a 401, work through the request rather than the endpoint.

1. Print the response headers and read WWW-Authenticate to learn the expected scheme.
2. Confirm the credential is actually being sent. A header dropped by a proxy, a redirect, or a client library is the single most common cause.
3. Check the scheme spelling and spacing in the Authorization header, for example the word Bearer followed by one space and the token.
4. Check whether the token has expired, and whether your refresh flow is running before the call rather than after the failure.
5. Confirm you are calling the environment the credential belongs to. Test credentials against a production host return 401 every time.
6. Check for an API key that belongs in a custom header or a query parameter rather than in Authorization.
7. For browser code, remember that a cross-origin request only carries cookies when credentials are explicitly enabled on both sides.
8. Rotate the credential if it may have been revoked, and store the new one outside the source code.

Log the failing request without the secret value itself. Logging tokens in plain text turns a small bug into a security incident.

When is a 401 status code not your fault?

Servers also return 401 for reasons entirely on their side: a misconfigured authentication service, an expired certificate on an identity provider, a deployment that lost its secret, or a maintenance window that disabled sign-in. Signs that point that way include the error appearing suddenly for a service that worked minutes earlier, several unrelated accounts failing together, and reports from other users at the same time. In that case, report it and wait rather than resetting passwords repeatedly.

What should you never do after a 401 error?

Never enter your password on a page you reached from an unexpected email, message, or advertisement offering to fix a sign-in problem. Never send a password, a one-time code, a session cookie, or an API token to anyone, including someone who says they are support staff. Never paste a token into a public forum, a paste site, or a chat when asking for help; replace it with a placeholder first. A 401 is a routine technical response, and no legitimate service resolves it by asking you for a secret.