401 Unauthorized: what it means and how to fix it

A 401 Unauthorized means the request needs valid credentials it didn't have: a sign-in, password or API key. How it differs from 403, and how to fix it.

1. The short answer

A 401 Unauthorized error means the page or API needs you to prove who you are, and the request didn't include valid credentials. Signing in, entering the right password, or sending a valid API key usually fixes it. The name is misleading: it means not authenticated, while 403 Forbidden is the code for authenticated but not allowed.

RFC 9110 says a 401 response must include a WWW-Authenticate header saying how to authenticate. That's what makes a browser show its own username and password box for sites using Basic authentication.

2. What you'll see

A browser pop-up asking for a username and password (Basic authentication), a page saying "401 Unauthorized" or "Authorization Required", a site redirecting you to its sign-in page, or, from an API, something like {"error": "invalid_token"} with a 401 status.

3. Common causes

• Not signed in, or the session expired.
• Wrong username or password for a password-protected folder.
• API key missing, mistyped, expired or revoked.
• The key is sent in the wrong format, such as Authorization: <key> when the API wants Authorization: Bearer <key>, or a stray space or newline copied with it.
• The Authorization header is lost on the way. Apache running PHP through CGI or FastCGI doesn't pass it to scripts by default, and browsers and curl drop it when a redirect goes to a different host.
• Cookies not saved or sent, because they're blocked, set for another domain (www versus non-www), or marked Secure on a plain HTTP page.
• A token signed for another environment, such as a test key used against the live API, or a token whose time checks fail because a server's clock is wrong.

4. How to fix a 401 as a visitor

1. Sign in again, on the site's main address.
2. Check your username and password; use the password reset if unsure.
3. Clear cookies for that site and try again, or try a private window.
4. Make sure your browser isn't blocking the site's cookies.
5. If you were sent a link to a private page, ask the owner for access.

5. How to fix a 401 as a developer

Check exactly what you're sending. Reproduce the call with curl so nothing hidden is involved, then compare with the provider's docs.

# Bearer token (most APIs)
curl -i https://api.example.com/v1/me -H "Authorization: Bearer $API_TOKEN"

# Basic authentication
curl -i -u username https://www.example.com/private/

Read the `WWW-Authenticate` header in the response. It often names the problem, for example Bearer error="invalid_token", error_description="The access token expired".

Keys in apps. Keep keys in environment variables, check the app reads the name you set, and that it's the live key for the live API. Rotate any key that was ever pasted into code or a chat.

Follow redirects carefully. If the API address redirects (http to https, or to another host), call the final address directly. Clients drop the Authorization header when a redirect leads to a different host.

6. How to fix a 401 on your own site

nginx. Basic authentication uses auth_basic and a password file. A 401 for everyone usually means a wrong path in auth_basic_user_file, or a password file nginx can't read (look in the error log).

# nginx: password-protect a folder
location /private/ {
    auth_basic "Private area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Apache and cPanel hosting. Protected folders use AuthType Basic with AuthUserFile in .htaccess. cPanel's Directory Privacy sets this up for you. If a PHP app or API never sees the Authorization header, add CGIPassAuth On (Apache 2.4.13 and later) to that folder's .htaccess.

Node, Express and Next.js. Return 401 when credentials are missing or invalid, and 403 when they're valid but not enough. For cookie sessions, check the cookie's Domain, Path, Secure and SameSite settings match how the site is reached; a cookie set on www.example.com isn't sent to example.com. Pick one main address; see www vs non-www.

WordPress. The REST API answers 401 (rest_not_logged_in) to requests without a valid sign-in or application password. Security plugins can also block the Authorization header; the Apache fix above often applies.

Cloudflare. Cloudflare passes the Authorization header through. Cloudflare Access, if you use it, puts its own sign-in in front of the site, so a sign-in loop there is an Access policy question.

7. On Cloudzyro

On Sites & Apps, API keys your site uses belong on its Environment variables tab. Changes apply on the next deploy, so after replacing a key, deploy again (or select Deploy now), or the site keeps sending the old one and the API keeps answering 401. See Environment variables.

8. How to check the status code

# Status and the authentication challenge
curl -sI https://api.example.com/v1/me | grep -i -E "^HTTP|www-authenticate"

In the browser's Network tab, click the request and look at the request headers (is there a cookie or authorization header?) and the response's www-authenticate header.

9. Related errors

• [403 Forbidden](/guides/403-forbidden-error): authenticated, or not needed, but still not allowed.
• [400 Bad Request](/guides/400-bad-request): a malformed request, which some APIs use for a badly formed token.
• [429 Too Many Requests](/guides/429-too-many-requests): too many attempts, common after repeated failed sign-ins.
• 407 Proxy Authentication Required: a proxy, not the site, wants credentials.

10. Sources

• RFC 9110, section 15.5.2: 401 Unauthorized
• RFC 9110, section 11.6.1: WWW-Authenticate
• MDN: 401 Unauthorized
• nginx: ngx_http_auth_basic_module
• Apache: CGIPassAuth