[ Web Proxy ]
URL:
Viewing: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/401 [Back]  [Original]
401 Unauthorized - HTTP | MDN
HTML

HTML: Markup language

HTML reference
HTML guides
Markup languages
CSS

CSS: Styling language

CSS reference
CSS guides
Layout cookbook
JavaScriptJS

JavaScript: Scripting language

JS reference
JS guides
Web APIs

Web APIs: Programming interfaces

Web API reference
Web API guides
All

All web technology

Technologies
Topics
Learn

Learn web development

Frontend developer course
Learn HTML
Learn CSS
Learn JavaScript
Tools

Discover our tools

About

Get to know MDN better

Blog
Toggle sidebar
  1. Web
  2. HTTP
  3. Reference
  4. HTTP response status codes
  5. 401 Unauthorized
Theme
  • OS default
  • Light
  • Dark
English (US)
Remember language Learn more

401 Unauthorized

The HTTP 401 Unauthorized client error response status code indicates that a request was not successful because it lacks valid authentication credentials for the requested resource. This status code is sent with an HTTP WWW-Authenticate response header that contains information on the authentication scheme the server expects the client to include to make the request successfully.

A 401 Unauthorized is similar to the 403 Forbidden response, except that a 403 is returned when a request contains valid credentials, but the client does not have permissions to perform a certain action.

In this article

Status

http
401 Unauthorized

Examples

Unauthorized request to a protected API

The following GET request is made to a URL www.example.com/admin that expects credentials in an Authorization header:

http
GET /admin HTTP/1.1
Host: example.com

The server responds with a 401 message and a WWW-Authenticate header indicating that the request must be authenticated and that Bearer auth (an access token) is the permitted authentication scheme:

http
HTTP/1.1 401 Unauthorized
Date: Tue, 02 Jul 2024 12:18:47 GMT
WWW-Authenticate: Bearer

Specifications

Specification
HTTP Semantics
# status.401

See also

Help improve MDN

Was this page helpful to you?
Yes No
Learn how to contribute

This page was last modified on Jun 22, 2026 by MDN contributors.

View this page on GitHub Report a problem with this content
Clear filter input
  1. HTTP
  2. Guides
  3. Overview of HTTP
  4. Evolution of HTTP
  5. A typical HTTP session
  6. HTTP messages
  7. Media types
    1. Common types
  8. Compression in HTTP
  9. HTTP caching
  10. HTTP authentication
  11. Using HTTP cookies
  12. Redirections in HTTP
  13. Conditional requests
  14. Range requests
  15. Client hints
  16. User-Agent reduction
  17. Compression Dictionary Transport
  18. Network Error Logging
  19. Content negotiation
    1. Default Accept values
  20. Browser detection using the UA string
  21. Connection management in HTTP/1.x
  22. Protocol upgrade mechanism
  23. Proxy servers and tunneling
    1. Proxy Auto-Configuration (PAC) file
  24. Security and privacy
    1. HTTP Observatory
    2. Practical implementation guides
    3. Permissions Policy
    4. Cross-Origin Resource Policy (CORP)
    5. IFrame credentialless
    6. Fetch metadata
    7. Cross-Origin Resource Sharing (CORS)
    8. CORS errors
      1. Reason: CORS disabled
      2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
      3. Reason: CORS header 'Access-Control-Allow-Origin' missing
      4. Reason: CORS header 'Origin' cannot be added
      5. Reason: CORS preflight channel did not succeed
      6. Reason: CORS request did not succeed
      7. Reason: CORS request external redirect not allowed
      8. Reason: CORS request not HTTP
      9. Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
      10. Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
      11. Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
      12. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
      13. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
      14. Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
      15. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
    9. Content Security Policy (CSP)
      1. Errors and warnings
  25. Reference
  26. HTTP headers
    1. Accept
    2. Accept-CH
    3. Accept-Encoding
    4. Accept-Language
    5. Accept-Patch
    6. Accept-Post
    7. Accept-Ranges
    8. Access-Control-Allow-Credentials
    9. Access-Control-Allow-Headers
    10. Access-Control-Allow-Methods
    11. Access-Control-Allow-Origin
    12. Access-Control-Expose-Headers
    13. Access-Control-Max-Age
    14. Access-Control-Request-Headers
    15. Access-Control-Request-Method
    16. Activate-Storage-Access
    17. Age
    18. Allow
    19. Alt-Svc
    20. Alt-Used
    21. Attribution-Reporting-Eligible
    22. Attribution-Reporting-Register-Source
    23. Attribution-Reporting-Register-Trigger
    24. Authorization
    25. Available-Dictionary
    26. Cache-Control
    27. Clear-Site-Data
    28. Connection
    29. Content-Digest
    30. Content-Disposition
    31. Content-DPR
    32. Content-Encoding
    33. Content-Language
    34. Content-Length
    35. Content-Location
    36. Content-Range
    37. Content-Security-Policy
    38. Content-Security-Policy-Report-Only
    39. Content-Type
    40. Cookie
    41. Critical-CH
    42. Cross-Origin-Embedder-Policy
    43. Cross-Origin-Embedder-Policy-Report-Only
    44. Cross-Origin-Opener-Policy
    45. Cross-Origin-Resource-Policy
    46. Date
    47. Device-Memory
    48. Dictionary-ID
    49. DNT
    50. Downlink
    51. DPR
    52. Early-Data
    53. ECT
    54. ETag
    55. Expect
    56. Expect-CT
    57. Expires
    58. Forwarded
    59. From
    60. Host
    61. Idempotency-Key
    62. If-Match
    63. If-Modified-Since
    64. If-None-Match
    65. If-Range
    66. If-Unmodified-Since
    67. Integrity-Policy
    68. Integrity-Policy-Report-Only
    69. Keep-Alive
    70. Last-Modified
    71. Link
    72. Location
    73. Max-Forwards
    74. NEL
    75. No-Vary-Search
    76. Observe-Browsing-Topics
    77. Origin
    78. Origin-Agent-Cluster
    79. Permissions-Policy
    80. Permissions-Policy-Report-Only
    81. Pragma
    82. Prefer
    83. Preference-Applied
    84. Priority
    85. Proxy-Authenticate
    86. Proxy-Authorization
    87. Range
    88. Referer
    89. Referrer-Policy
    90. Refresh
    91. Report-To
    92. Reporting-Endpoints
    93. Repr-Digest
    94. Retry-After
    95. RTT
    96. Save-Data
    97. Sec-Browsing-Topics
    98. Sec-CH-Device-Memory
    99. Sec-CH-DPR
    100. Sec-CH-Prefers-Color-Scheme
    101. Sec-CH-Prefers-Reduced-Motion
    102. Sec-CH-Prefers-Reduced-Transparency
    103. Sec-CH-UA
    104. Sec-CH-UA-Arch
    105. Sec-CH-UA-Bitness
    106. Sec-CH-UA-Form-Factors
    107. Sec-CH-UA-Full-Version
    108. Sec-CH-UA-Full-Version-List
    109. Sec-CH-UA-Mobile
    110. Sec-CH-UA-Model
    111. Sec-CH-UA-Platform
    112. Sec-CH-UA-Platform-Version
    113. Sec-CH-UA-WoW64
    114. Sec-CH-Viewport-Height
    115. Sec-CH-Viewport-Width
    116. Sec-CH-Width
    117. Sec-Fetch-Dest
    118. Sec-Fetch-Mode
    119. Sec-Fetch-Site
    120. Sec-Fetch-Storage-Access
    121. Sec-Fetch-User
    122. Sec-GPC
    123. Sec-Private-State-Token
    124. Sec-Private-State-Token-Crypto-Version
    125. Sec-Private-State-Token-Lifetime
    126. Sec-Purpose
    127. Sec-Redemption-Record
    128. Sec-Speculation-Tags
    129. Sec-WebSocket-Accept
    130. Sec-WebSocket-Extensions
    131. Sec-WebSocket-Key
    132. Sec-WebSocket-Protocol
    133. Sec-WebSocket-Version
    134. Server
    135. Server-Timing
    136. Service-Worker
    137. Service-Worker-Allowed
    138. Service-Worker-Navigation-Preload
    139. Set-Cookie
    140. Set-Login
    141. SourceMap
    142. Speculation-Rules
    143. Strict-Transport-Security
    144. Supports-Loading-Mode
    145. TE
    146. Timing-Allow-Origin
    147. Tk
    148. Trailer
    149. Transfer-Encoding
    150. Upgrade
    151. Upgrade-Insecure-Requests
    152. Use-As-Dictionary
    153. User-Agent
    154. Vary
    155. Via
    156. Viewport-Width
    157. Want-Content-Digest
    158. Want-Repr-Digest
    159. Warning
    160. Width
    161. WWW-Authenticate
    162. X-Content-Type-Options
    163. X-DNS-Prefetch-Control
    164. X-Forwarded-For
    165. X-Forwarded-Host
    166. X-Forwarded-Proto
    167. X-Frame-Options
    168. X-Permitted-Cross-Domain-Policies
    169. X-Powered-By
    170. X-Robots-Tag
    171. X-XSS-Protection
  27. HTTP request methods
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  28. HTTP response status codes
    1. 100 Continue
    2. 101 Switching Protocols
    3. 102 Processing
    4. 103 Early Hints
    5. 200 OK
    6. 201 Created
    7. 202 Accepted
    8. 203 Non-Authoritative Information
    9. 204 No Content
    10. 205 Reset Content
    11. 206 Partial Content
    12. 207 Multi-Status
    13. 208 Already Reported
    14. 226 IM Used
    15. 300 Multiple Choices
    16. 301 Moved Permanently
    17. 302 Found
    18. 303 See Other
    19. 304 Not Modified
    20. 307 Temporary Redirect
    21. 308 Permanent Redirect
    22. 400 Bad Request
    23. 401 Unauthorized
    24. 402 Payment Required
    25. 403 Forbidden
    26. 404 Not Found
    27. 405 Method Not Allowed
    28. 406 Not Acceptable
    29. 407 Proxy Authentication Required
    30. 408 Request Timeout
    31. 409 Conflict
    32. 410 Gone
    33. 411 Length Required
    34. 412 Precondition Failed
    35. 413 Content Too Large
    36. 414 URI Too Long
    37. 415 Unsupported Media Type
    38. 416 Range Not Satisfiable
    39. 417 Expectation Failed
    40. 418 I'm a teapot
    41. 421 Misdirected Request
    42. 422 Unprocessable Content
    43. 423 Locked
    44. 424 Failed Dependency
    45. 425 Too Early
    46. 426 Upgrade Required
    47. 428 Precondition Required
    48. 429 Too Many Requests
    49. 431 Request Header Fields Too Large
    50. 451 Unavailable For Legal Reasons
    51. 500 Internal Server Error
    52. 501 Not Implemented
    53. 502 Bad Gateway
    54. 503 Service Unavailable
    55. 504 Gateway Timeout
    56. 505 HTTP Version Not Supported
    57. 506 Variant Also Negotiates
    58. 507 Insufficient Storage
    59. 508 Loop Detected
    60. 510 Not Extended
    61. 511 Network Authentication Required
  29. CSP directives
    1. base-uri
    2. block-all-mixed-content
    3. child-src
    4. connect-src
    5. default-src
    6. fenced-frame-src
    7. font-src
    8. form-action
    9. frame-ancestors
    10. frame-src
    11. img-src
    12. manifest-src
    13. media-src
    14. object-src
    15. prefetch-src
    16. report-to
    17. report-uri
    18. require-trusted-types-for
    19. sandbox
    20. script-src
    21. script-src-attr
    22. script-src-elem
    23. style-src
    24. style-src-attr
    25. style-src-elem
    26. trusted-types
    27. upgrade-insecure-requests
    28. worker-src
  30. Permissions-Policy directives
    1. accelerometer
    2. ambient-light-sensor
    3. aria-notify
    4. attribution-reporting
    5. autoplay
    6. bluetooth
    7. browsing-topics
    8. camera
    9. captured-surface-control
    10. ch-ua-high-entropy-values
    11. compute-pressure
    12. cross-origin-isolated
    13. deferred-fetch
    14. deferred-fetch-minimal
    15. display-capture
    16. encrypted-media
    17. fullscreen
    18. gamepad
    19. geolocation
    20. gyroscope
    21. hid
    22. identity-credentials-get
    23. idle-detection
    24. language-detector
    25. language-model
    26. local-fonts
    27. local-network
    28. local-network-access
    29. loopback-network
    30. magnetometer
    31. microphone
    32. midi
    33. on-device-speech-recognition
    34. otp-credentials
    35. payment
    36. picture-in-picture
    37. private-state-token-issuance
    38. private-state-token-redemption
    39. publickey-credentials-create
    40. publickey-credentials-get
    41. screen-wake-lock
    42. serial
    43. speaker-selection
    44. storage-access
    45. summarizer
    46. translator
    47. usb
    48. web-share
    49. window-management
    50. xr-spatial-tracking
  31. HTTP resources and specifications
MDN

Your blueprint for a better internet.

MDN
Contribute
Developers
Mozilla

Portions of this content are 19982026 by individual mozilla.org contributors. Content available under a Creative Commons license.

Web Proxy Viewer  |  New URL  |  Original Page