401 Unauthorized
This page or API needs a login, and your request didn't include valid credentials. Signing in, or sending a valid token, should fix it.
Quick checks
- Log out and log back in.
- Check the username and password for typos and Caps Lock.
- For an API, check the token hasn't expired.
If you’re visiting the site
Sign in again
- Log out, clear the site's cookies, and log in again.
- If the browser shows a username/password dialog, the site uses HTTP authentication; use the credentials you were given.
If you run the site
For API calls
- Send the token in the right header, usually
Authorization: Bearer <token>. - Check expiry, audience and the clock on the client (JWTs fail when clocks drift).
- Test with curl:
curl -i -H "Authorization: Bearer $TOKEN" https://api.example.com/me.
- Send the token in the right header, usually
Return the right code
- Use 401 (with a
WWW-Authenticateheader) when credentials are missing or invalid, and 403 when they're valid but lack permission.
- Use 401 (with a
Still not working?
If you're sure your credentials are right and still get 401, your account may be locked or the site's login service may be down. Contact support.
See what’s happening
LightAtom's connections view shows which servers an app on your Mac is talking to when it keeps asking you to sign in.
Frequently asked questions
What is the difference between 401 and 403?
401 means “who are you?”: authentication is missing or invalid, so logging in can fix it. 403 means “I know who you are, and no”: you lack permission.
Why do I get 401 after I logged in?
Your session or token expired, a cookie wasn't saved (check that cookies aren't blocked for the site), or the app sends the token to the wrong place.
Does 401 mean my password is wrong?
Often, but not always. It can also mean an expired session, a missing token or a clock problem on your device.
What is the WWW-Authenticate header?
A header a server sends with 401 to say how to authenticate, such as Basic or Bearer. Browsers show a login dialog for Basic.