HTTP 401 Unauthorized

The request lacks valid authentication credentials.

Use 401 when the client must authenticate or refresh invalid credentials; include an appropriate WWW-Authenticate challenge.

httpstatus codeauth

Response (http)

HTTP/1.1 401 Unauthorized

Use 401 when the client must authenticate or refresh invalid credentials; include an appropriate WWW-Authenticate challenge.

Common mistakes

Returning 401 without a WWW-Authenticate challenge, or using it for authorization failures that mean 403.

Registry reference: RFC9110, Section 15.5.2

Sources