401 Unauthorized
Web/HTTP
Low severity
HTTP 401 — Unauthorized
The request lacked valid authentication credentials, or the token or session expired.
Last reviewed 2026-08-29 by the Tech Issue Guide team.
Symptoms
- A page redirects to login or shows “401 Unauthorized.”
- An API that worked earlier now returns 401.
- It happens after leaving a tab open for hours.
What causes 401 Unauthorized
- The login session or access token has expired.
- The Authorization header is missing, malformed, or using the wrong scheme.
- The account genuinely lacks access to that resource.
- The device clock is wrong, so time-based token validation fails.
How to fix it — 3 steps
- Sign out and back in to get a fresh session; clear stale auth cookies for the site.
- For APIs, confirm the Authorization header is present, correctly formatted (e.g. “Bearer <token>”), and the token is not expired.
- Check that the account has permission for the resource and that the system date and time are set automatically.
Terminal / CLI command
curl -i -H "Authorization: Bearer <TOKEN>" "https://api.example.com/resource"A 200 here with a fresh token confirms the credentials path; a 401 means the token or its formatting is the problem.
How to confirm the fix: The resource loads or the API returns 200 with a renewed token or session.
Prevent it from coming back
Implement token refresh before expiry in clients, and keep device clocks synced automatically.
Frequently asked questions
What is the difference between 401 and 403?
401 means “we do not know who you are” (authenticate first). 403 means “we know who you are and you still cannot have this.”