4xx Client error

401 Unauthorized

Authentication is required or the credentials are invalid.

Despite the name, it means “unauthenticated”: the server doesn’t know who you are. It should include a WWW-Authenticate header.

Common causes and fixes

• Check the header format, e.g. Authorization: Bearer <token> (note the space).
• The token may have expired — decode a JWT to check its exp claim, then refresh it.
• Make sure you’re using the key for the right environment (test vs production).
• If you are logged in but lack permission, the correct code is 403, not 401.

Example response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Date: Thu, 22 Oct 2026 08:00:00 GMT

Check a URL’s status with curl -I https://example.com, which prints the status line and headers.

Related status codes

• 403 Forbidden

Related tools

curl to Code · LLM API Playground · LLM Stream Parser