401 Unauthorized
Authentication is missing or invalid.
What it means
Despite the name, 401 means "not authenticated". The server should send WWW-Authenticate describing the accepted scheme.
What your client should do
Send valid credentials: check the token, its expiry and the Authorization header format. Refresh an expired token.
Should you retry?
Only after you change the request.
Security angle
Responses should be identical whether the user exists or not, so attackers cannot enumerate accounts.
Try it
The free practice API returns this status on demand, with the headers a well-behaved API would send. Call GET /api/play/status/401 from Endpoint Client and open the Explain tab.
Related codes
Defined in RFC 9110. All status codes and headers