// Client error

401 Unauthorized

The request lacks valid authentication credentials. Despite the name, this status is about authentication rather than authorization.

Common causes

The Authorization header is missing.
A bearer token is expired or invalid.
The authentication scheme is incorrect.
A signed request cannot be verified.

Troubleshooting

Check that credentials are present without logging them.
Verify token expiry, audience and issuer.
Inspect the WWW-Authenticate response header.
Use 403 when authentication is valid but access is forbidden.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer
Content-Type: application/json

{ "code": "invalid_token" }

Related status codes

400 Bad Request 404 Not Found 422 Unprocessable Content

// GET STARTED

Inspect the complete API response.

Use REST Test to send a request and review its status, headers, timing and body together.