401 Unauthorized: causes, fixes and how it differs from 403

401 means the server doesn't know who you are. Missing headers, expired tokens, wrong formats and rotated keys, and how to read the WWW-Authenticate header.

October 5, 2026 · 4 min read · By the Spot Downtime team

401 Unauthorized means the server doesn't know who you are. Either no credentials were sent, or the ones sent weren't accepted. Despite the name, it's about authentication (who you are), not authorization (what you're allowed to do). That second one is 403 Forbidden.

401 vs 403 in one table

	401 Unauthorized	403 Forbidden
The server is saying	Who are you?	I know who you are, and the answer is no.
Will logging in help?	Yes	No, you need different permissions
Typical cause	Missing, expired or wrong token	Valid user without access, or a firewall rule

The usual causes

No credentials sent

The request has no Authorization header or session cookie at all. Common after moving code from a browser (where cookies are sent automatically) to a script, or when a proxy strips the header. Some setups, such as Apache with PHP-FPM, drop Authorization unless you pass it on explicitly.

The token expired

Access tokens often last an hour or less. A job that works in the morning and fails in the afternoon is usually using a token it never refreshes. Check the token's expiry (for a JWT, the exp claim) and refresh before it runs out.

The wrong format

Small differences matter. Compare what the API expects with what you send:

bash

# Bearer token
curl -i https://api.example.com/me -H "Authorization: Bearer $TOKEN"

# API key in a custom header
curl -i https://api.example.com/me -H "X-API-Key: $KEY"

# Basic auth (curl builds the header for you)
curl -i -u user:password https://example.com/admin

A missing Bearer prefix, a key with a trailing newline pasted from a file, or a test key used against the live API all produce the same 401.

The key was rotated or revoked

Someone regenerated the key in the provider's dashboard, and one forgotten server still has the old one.

Read the WWW-Authenticate header

A correct 401 response includes a WWW-Authenticate header saying which scheme the server wants, and sometimes why it refused:

http

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token", error_description="The access token expired"

HTTP headers checkerInspect the status code and response headers of any URL, including WWW-Authenticate.

Monitoring a protected endpoint

A health check that gets 401 tells you only that the login wall works. To check the endpoint itself, send credentials with the check: a read-only API key with as few permissions as possible, in a custom header.

Spot Downtime's API monitors can send headers such as Authorization or an API key with every check, so a 401 then means something real changed: a revoked key, or broken auth on your side.

Seeing 403 instead? Read 403 Forbidden: causes and fixes.