401 401 Unauthorized

Authentication is required and has not been provided or has failed.

When you'll see it

When a request needs a login and has no valid credentials: a missing, expired or mistyped token or API key. The name says unauthorized, but it means unauthenticated.

What to check

That the Authorization header is sent and has the right format, such as Bearer followed by the token.
That the token hasn't expired, and refresh it if it has.
The WWW-Authenticate header, which tells which login method the server expects.
That a proxy or redirect doesn't strip the Authorization header on the way.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"

SEO impact

Google cannot crawl or index content behind authentication. Pages returning 401 are excluded from the index.

At a glance

Status code	401
Group	4xx Client Errors
Class	4xx