What it means
Despite the name, 401 means “unauthenticated”: the server doesn't know who you are, or the credentials are invalid. The response must include a WWW-Authenticate header. If the server knows who you are but won't let you in, the correct code is 403.
Most common causes
- You're not signed in or your session has expired.
- An API call without an Authorization header or with an expired token.
- A wrong username or password with Basic Auth.
- An incorrect device clock that makes a token look invalid.
What you can do as a visitor
- Sign out and sign back in.
- Clear the site's cookies if your login doesn't stick.
- Check that your device's clock is correct.
What the site owner or developer should do
- Return 401 with WWW-Authenticate for unauthenticated requests, and 403 for missing permissions.
- Check token expiry and refresh (refresh tokens).
- In APIs, return a clear message: missing, invalid or expired key.
Impact on SEO and Google
Google doesn't index login pages that return 401. Don't put public content behind a 401 if you want it to appear in search.
Frequently asked questions
What's the difference between 401 and 403?
401: you're not authenticated. 403: you're authenticated (or it doesn't matter), but access is forbidden.
Why am I getting a 401 from an API?
Most often the Authorization header is missing or the token has expired.