Symptoms

  • A page redirects to login or shows “401 Unauthorized.”
  • An API that worked earlier now returns 401.
  • It happens after leaving a tab open for hours.

What causes 401 Unauthorized

  • The login session or access token has expired.
  • The Authorization header is missing, malformed, or using the wrong scheme.
  • The account genuinely lacks access to that resource.
  • The device clock is wrong, so time-based token validation fails.

How to fix it

  1. Sign out and back in to get a fresh session; clear stale auth cookies for the site.
  2. For APIs, confirm the Authorization header is present, correctly formatted (e.g. “Bearer <token>”), and the token is not expired.
  3. Check that the account has permission for the resource and that the system date and time are set automatically.

Terminal / CLI command

curl -i -H "Authorization: Bearer <TOKEN>" "https://api.example.com/resource"

A 200 here with a fresh token confirms the credentials path; a 401 means the token or its formatting is the problem.

How to confirm the fix: The resource loads or the API returns 200 with a renewed token or session.

Prevent it from coming back

Implement token refresh before expiry in clients, and keep device clocks synced automatically.