4xx · Client errorretryable
401Unauthorized
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided.
What this code obliges you to do
Retry
Safe to retry
Repeating the same request can succeed, so a client may back off and try again. Honour Retry-After when the response sends one.
Caching
Not cacheable by default
Caches will not store this response unless you send explicit freshness headers saying they may.
Response body
Body allowed
You may return a payload explaining the outcome — for an error, a machine-readable problem document is worth the effort.
What usually causes it
31
Expired JWT token
2
Missing Authorization header
3
Incorrect password
Effect on search
Pages returning 401 are dropped from search indexes natively. Ensure no public content requires authentication.
How to send it
1Python (Django)
return HttpResponse('Unauthorized', status=401)Codes people confuse with this one
1Class4xx
RetrySafe
CacheNo
BodyAllowed