401 Unauthorized
Misnamed: it means UNAUTHENTICATED — we do not know who you are.
401Client error
- What it means
- Misnamed: it means UNAUTHENTICATED — we do not know who you are.
- In practice
- The most misnamed code in the protocol. 401 does not mean “you lack permission” — it means the server does not know who you are: no credentials, an expired token, a bad signature. Authenticate (or re-authenticate) and retry. If you are signed in and still refused, that is 403’s job. Common real causes: an expired JWT, an Authorization header stripped by a proxy, or credentials sent to the wrong domain.
- Whose problem is it?
- The request. Retrying it unchanged will get the same answer.
Often confused with