---
title: "401 error (Unauthorized)"
description: "The HTTP 401 Unauthorized error means the request lacks valid authentication. Learn what triggers it, how to fix it and how it differs from the 403 error."
url: "https://nodea.io/en/glossary/http-401-error"
lang: "en"
updated: "2026-07-13"
---

# 401 error (Unauthorized)

> The 401 Unauthorized error is an HTTP status code indicating that a request was rejected because it lacks valid authentication credentials — a missing or expired token, API key or login.

**The 401 error** (Unauthorized) is an [HTTP](https://nodea.io/en/glossary/http) status code telling the client that a request was not fulfilled because the resource requires authentication and no valid credentials were provided. Despite the literal name, the code is really about authentication rather than authorization — the server simply does not know who is asking.

## How the 401 error works

The standard flow looks like this: the client requests a protected resource without credentials, the server responds with 401 and a WWW-Authenticate header naming the expected scheme (Basic, Bearer, Digest), and the client retries with an Authorization header attached. In API traffic the usual culprits are an expired or malformed [JWT](https://nodea.io/en/glossary/jwt), a wrong API key, or a missing Authorization header altogether. On traditional websites, 401 responses typically come from directory protection with Basic Auth (.htpasswd files) or from an expired user session that the application maps to this status.

## Practical applications

Troubleshooting starts with the credentials themselves: verify the username and password, check the token's expiry claim and confirm it is sent in the right header and format. Next, review the server-side Basic Auth configuration, clear browser cookies and cache, and make sure the endpoint does not expect a different mechanism — an OAuth bearer token instead of a static key, for instance. From a security standpoint, a burst of 401 responses in the access log is a valuable signal: it often marks a brute-force attempt against a login endpoint, best contained with fail2ban-style banning or rate limiting. The neighboring status is worth knowing too — see [403 error](https://nodea.io/en/glossary/http-403-error), where the server knows the client but refuses access regardless.

### What is the difference between a 401 and a 403 error?

A 401 means the server does not know who you are — authentication is missing or invalid, and supplying correct credentials will grant access. A 403 means the server recognizes you but refuses access anyway: no amount of re-authentication will help, because permissions are lacking.

## Related

- [403 error (Forbidden)](https://nodea.io/en/glossary/http-403-error)
- [HTTP](https://nodea.io/en/glossary/http)
- [JWT](https://nodea.io/en/glossary/jwt)
- [OAuth](https://nodea.io/en/glossary/oauth)
- [Password](https://nodea.io/en/glossary/password)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/bad-401.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)