# 401 Unauthorized

> The request lacks valid authentication credentials. The client must authenticate.

Source: https://apiguide.dev/status-codes/401
Class: client-error
Defined in: RFC 9110, Section 15.5.2 <https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.2>
Updated: 2026-07-10

## What does HTTP status code 401 mean?

The 401 Unauthorized status code indicates that the client must authenticate itself to receive the requested response.

## When to use it in APIs

Use 401 when the client fails to provide an API key, bearer token, or session credentials, or when the credentials provided are invalid or expired. A 401 response must include a `WWW-Authenticate` header naming the authentication scheme the client should use (e.g. `WWW-Authenticate: Bearer realm="api"`).

## How it compares to other codes

* **403 Forbidden**: Use 403 when the client is authenticated but does not possess the permissions/scopes to access the resource.