401 Unauthorized
The request needs valid credentials
Seen in APIs, browsers, web servers
The server did not accept the credentials sent, or none were sent, so it will not process the request.
Common causes
- No Authorization header, cookie or API key was sent.
- An expired, revoked or mistyped token or password.
- The wrong authentication scheme, e.g. Basic sent where Bearer is expected.
- A clock out of sync, making a fresh JWT look expired or not yet valid.
How to fix it
- Check the WWW-Authenticate response header: it names the scheme the server expects.
- Refresh or regenerate the token and confirm it is sent on every request.
- Check proxies or redirects are not stripping the Authorization header.
- Sync the client clock with NTP if tokens fail right after being issued.
Got a different message? Paste it into the error explainer.
Related errors
- 502 Bad Gateway · The proxy got a bad response from the server behind it
- 504 Gateway Timeout · The server behind the proxy took too long
- Error 520: Web server is returning an unknown error · Cloudflare got an empty or invalid response
- 429 Too Many Requests · You've hit a rate limit
- 400 Bad Request · The server could not understand the request
- 403 Forbidden · The server refuses to allow this request
- 404 Not Found · Nothing exists at this URL
- 405 Method Not Allowed · This URL does not accept that HTTP method
- 410 Gone · The resource was removed on purpose
- 414 Request-URI Too Large · The URL is longer than the server accepts
- 500 Internal Server Error · The application hit an error it did not handle
- 400 Bad Request: The plain HTTP request was sent to HTTPS port · Plain HTTP was sent to a port that expects TLS