What 401 means
Despite the name, 401 means "unauthenticated": the server doesn't know who you are. Your API key or token is missing, expired, malformed or sent in the wrong place.
Common causes
- No API key or token was sent.
- The key is wrong, revoked, or for a different environment (test vs live).
- The token has expired (check its exp claim).
- The key is in the wrong place, e.g. a query parameter instead of a header.
How to fix it
If you're calling an API
- Check the docs for where the key goes: Authorization: Bearer …, an X-API-Key header, or a query parameter.
- Decode your JWT to check it hasn't expired, then refresh it.
- Make sure you're not sending a test key to the live endpoint.
If you run the server
- Send a WWW-Authenticate header describing the expected scheme, and say in the body why auth failed.
Should you retry?
Only after fixing or refreshing the credentials.
Example response
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token"
Content-Type: application/problem+json
{
"type": "about:blank",
"title": "Unauthorized",
"status": 401,
"detail": "Authentication is missing or invalid."
}Related headers: Authorization, WWW-Authenticate.
Defined in: RFC 9110 (HTTP Semantics). 401 is a client error: change the request before retrying.
Debugging an API call? Convert your request with the cURL converter, check the response with the JSON formatter, or decode your token with the JWT decoder.