Status codes · one code401 — Unauthorized
What a 401 Unauthorized response means, who is at fault, what a visitor should do and what the server owner should do.
Open the reference on this codeWhat to do
If it is someone else's site
Sign in again — that is enough in the vast majority of cases: the session expired. If signing in does not help and you are sure the access should be there, the problem is no longer a 401: the server would recognise you and answer 403.
If it is your server
A 401 must carry WWW-Authenticate — without it the client does not know what to present, and standard libraries will not retry. Keep two cases apart: not authenticated is 401, authenticated but not allowed is 403. The common mistake runs the other way: an expired token is answered with 403, and the client never tries to refresh it, because retrying a 403 is pointless.
Easily confused with
the server recognised you but forbids the action. Signing in again will not help: this is about rights.
403 →the same, but it is the proxy demanding authentication rather than the site.
407 →a protected resource is sometimes returned as 404 on purpose — so as not to confirm that it exists.
404 →How to check
see whether WWW-Authenticate arrives and which scheme is required
check one specific token instead of guessing from the interface
The reference holds sixty-four codes searchable by number, name and meaning — plus a breakdown of confusing pairs such as 401 and 403.
Updated