A 401 means the server needs to know who you are, and the request didn't prove it: no login, an expired session, or a wrong or missing API key. For a person, logging in again usually fixes it. For an app talking to an API, check the key or token being sent, whether it has expired, and whether it was recently changed or revoked.
What's the problem
A page or app shows "401 Unauthorized", or an app stops loading data and the browser's Network tab shows 401s. Often it starts suddenly, after a password change, a key rotation, or a deploy.
Why it happens
- The session expired and the app doesn't send people back to the login page.
- An API key or token is missing, expired or revoked. Keys are often rotated for security and the app isn't updated.
- The key is set in one environment but not another, for example in testing but not on the live server.
- The token is sent in the wrong place or format, such as without the
Bearerprefix. - The server's clock is wrong, making time-limited tokens look expired.
How to fix it
- Log out and in again to rule out an expired session.
- For API calls, check which key the live app is using and whether it's still valid with the provider.
- Check environment variables on the live server contain the current keys.
- Check the request format against the API's docs.
- If it started at a specific time, look for a key rotation, password change or deploy at that moment.
- Make the app handle 401s by sending the user to log in again, instead of showing a broken page.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows whether your site loads, how fast, and where its redirects go; up to 50 pages from your sitemap, listing any that fail or are slow, plus broken links on them. With Cloudflare connected, it also shows which pages returned server errors (5xx) to visitors, and when; which requests the firewall blocked, by Cloudflare's own rule names; recent deploys and account changes, with their times.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- MDN Web Docs: 401 Unauthorizedreference
The HTTP 401 Unauthorized client error response status code indicates that a request was not successful because it lacks valid authentication credentials for the requested resource.