The short version
- 01Open the site's normal sign-in page and authenticate with the intended account.
- 02Read the response's WWW-Authenticate challenge when diagnosing an API request.
- 03Send credentials using the authentication scheme documented for the endpoint.
- 04Obtain a new access token through the normal flow when a Bearer token is invalid.
- 05Stop repeating unchanged credentials when the server continues to reject authentication.
- 06Give the site owner the failing URL, time and redacted error details if sign-in still fails.
Raw message
401 Unauthorized
Likely causes
- The request reached a protected resource without accepted credentials.
- An OAuth access token expired, was revoked or is malformed.
- The client sent a different authentication scheme from the one the server expects.
- The browser or client did not send the credentials needed by the requested endpoint.
What 401 tells you
Despite the word Unauthorized, 401 is primarily an authentication failure: the request did not carry valid credentials for the resource. HTTP requires a WWW-Authenticate response header describing at least one accepted challenge. The response body may explain more.
Check the response on the request that actually failed. A site can load its public page successfully while a protected API request returns 401. The status describes that request, not the health of the entire internet connection.
If you are visiting a website
Return to the site's normal sign-in page, sign in, and reopen the intended page. If the site uses browser HTTP authentication, the browser may show a credentials prompt instead of a login form. Use credentials for that service; a password for an unrelated account will not satisfy the challenge.
Our diagnostic recommendation is to compare a public page with the protected page after signing in. If public content works but the same protected request fails, report that distinction. Repeatedly resetting your router does not address the rejected credentials.
If you are calling or maintaining an API
For OAuth Bearer authentication, inspect the challenge for invalid_token. RFC 6750 uses this for expired, revoked or otherwise invalid tokens; obtain a replacement through the provider's documented authorization flow. Send the access token in the Authorization header with the Bearer scheme. Keep tokens out of shared logs and screenshots.
An insufficient_scope error instead belongs to the permission branch and normally uses 403. A new token with the same inadequate permissions is not a remedy. As an owner, compare what your client sent with what your authentication layer received, and keep the response challenge consistent with the endpoint's requirements.
Sources and review notes
Checked on . Based on HTTP and OAuth standards and MDN documentation. Browser comparisons are editorial diagnostic guidance; providers can add their own error details.