The 401 error code, named Unauthorized, tells you that the page or service wants proof of who you are, and the proof you sent was missing, wrong or out of date. The word "unauthorized" is a little misleading. In practice it means "not authenticated": the server does not yet know who you are.
It appears on password protected pages, admin areas, private APIs and apps whose login has expired. Often you can solve it in a minute by signing in again. The rest of this page explains the causes, the difference from 403 and what developers should check.
Common causes
1Wrong username or password
How to tellThe login box returns again or says credentials are invalid
What fixes itRetype carefully, check caps lock, or reset the password
2Session or token expired
How to tellWorked earlier, fails after a long idle time
What fixes itSign out, sign in again and retry the page
3Saved login in the browser is stale
How to tellSame account opens fine in a private window
What fixes itClear cookies and saved logins for that site
4Page is protected and you have no login
How to tellA browser box asks for a username and password
What fixes itAsk the site owner for access details
5API key or token missing or wrong
How to tellDeveloper call returns 401 with a message about credentials
What fixes itSend a valid key in the right header and check expiry
6Device date and time are wrong
How to tellSecure logins fail only on this phone or computer
What fixes itUse the automatic date and time option
How to fix it, step by step
Read the message on the page
Look for lines like "Authentication required" or "Invalid credentials". A box asking for a username and password means the page is protected on purpose, and you need the details from whoever manages it.
Sign out fully, then sign in again
Use the site's sign out option, close the tab, open it again and log in fresh. This replaces an expired session with a new one.
Type the login by hand
Autofill can fill an old password. Type the username and password yourself, and check that caps lock is off. If you are unsure, use the Forgot password link on the official site.
Clear cookies and saved logins for that site
Open the browser's site settings, remove stored data for the site, and visit it again. This removes the old login that is being sent with every request.
Check the phone's date, time and time zone
On Android go to Settings, then System, then Date and time; on an iPhone it is under General, then Date and Time. Choose the automatic option, because a wrong clock makes secure sign in tokens look out of date.
Try another browser or device
If the login works there, the first browser holds a bad saved state. If it fails everywhere, the account itself may be locked, expired or not allowed for that page.
Ask the site or your office admin
For work or school portals, your access may have been removed or may need renewal. Contact the helpdesk with the page address and the time you saw the error.
What the 401 error code really means
A web server asks two questions in order. First, who are you? Then, are you allowed to do this? A 401 is the answer to the first question: the server could not identify you. It normally comes with a header telling the browser which kind of sign in is accepted, which is why a login box often pops up.
You open a school results page and see 401 Unauthorized. Access is denied due to invalid credentials. Your saved password is probably old. Resetting it on the school's own site and logging in again opens the page.
401 error code vs 403
| Code | Server's view | What helps |
|---|---|---|
| 401 | I do not know who you are | Sign in with valid details |
| 403 | I know you, but you may not enter | Request permission |
| 400 | I cannot read your request | Fix the link or data |
| 404 | That page does not exist | Check the address |
Open the guide for 403 Forbidden if signing in again does not help, or 400 Bad Request if the page complains about the request itself. A missing page is a 404 instead.
HTTP error code 401 in a REST API: what developers check
- Confirm that the request includes the
Authorizationheader, and that the scheme (Basic or Bearer) matches what the API expects. - Check whether the token has expired, and refresh it.
- Make sure the key belongs to the right environment, since a test key fails on a live server.
- Look for stray spaces or line breaks copied into the key.
- Do not send keys in a link where they can be saved in logs.
Never share passwords, one time codes or keys with anyone who contacts you about this error. Real support teams do not ask for them.
When the sign in details are correct but 401 stays
Check whether a proxy, school filter or company network sits in between, as some ask for their own login first. Also watch for password changes made on another device: many services sign you out everywhere after a change, and the old session keeps showing 401 until you log in again. If the site is yours, check that the web server's login file or the app's auth service is running and that the clock on the server is correct.
Frequently asked questions
What is 401 error code and what does it mean?
It means the page needs valid authentication and the request did not carry it, or the details were wrong or expired. Signing in correctly normally solves it.
How do I fix a 401 unauthorized error?
Sign out and in again, type the password by hand, clear cookies for the site and check your device clock. If a box asks for a username, get the details from the site owner.
How do 401 and 403 differ?
A 401 means the server does not know who you are. A 403 means it knows you but your account is not permitted to open that page, so logging in again will not help.
Can a wrong date on my phone cause a 401?
Yes. Secure logins use time limited tokens, and a clock that is far off can make a valid token look expired. Use the automatic setting.
Is the 401 error code a sign of a hacked account?
Not by itself. It usually means expired or wrong login details. If you also get unexpected sign in alerts, change your password from the official site.