What does HTTP status code 401 mean?
The 401 Unauthorized status code indicates that the client must authenticate itself to receive the requested response.
When to use it in APIs
Use 401 when the client fails to provide an API key, bearer token, or session credentials, or when the credentials provided are invalid or expired. A 401 response must include a WWW-Authenticate header naming the authentication scheme the client should use (e.g. WWW-Authenticate: Bearer realm="api").
How it compares to other codes
- 403 Forbidden: Use 403 when the client is authenticated but does not possess the permissions/scopes to access the resource.
