4014xx
4xx — Client Error
Unauthorized
Although the HTTP standard specifies 'unauthorized', semantically this response means 'unauthenticated'.
What it means
The HTTP 401 Unauthorized client error status response code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource.
This status is sent with a `WWW-Authenticate` header that contains information on how to authorize correctly.
How it works
- 1The client requests a protected resource without an authorization token.
- 2The server returns 401 Unauthorized, often with a WWW-Authenticate header.
- 3The client prompts the user to log in or attaches an API key, then retries.
Why you're seeing this
- • Missing Authorization header.
- • Expired or invalid token.
How to fix it
- • Provide a valid authentication token (Bearer, Basic, cookies, etc.) in the request.
Framework Implementations
Express.js
app.get('/dashboard', (req, res) => {
if (!req.isAuthenticated()) {
return res.status(401).send('Unauthorized');
}
});Real-Life Scenarios
Use this when the user is not logged in, their session has expired, or their API token is missing/invalid.
Expired JWT Token
A user's JWT expires. The next API request they make returns a 401. The frontend catches this and redirects them to the login page.
HTTP Transaction
1. Client Request
GET /api/private-data HTTP/1.1 Host: api.com
2. Server Response
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer
Content-Type: application/json
{"error": "Authentication required"}SEO Implications
Search engines cannot crawl protected content. Ensure public content does not accidentally return 401.