HTTP 401 vs 403

Use 401 when authentication is missing or invalid, and 403 when the user is authenticated but not allowed to access the resource.

Quick Difference

Key / CodeDescription
401 UnauthorizedThe request needs valid authentication credentials.
403 ForbiddenThe request is understood, but the authenticated user is not allowed.

401 Example

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"

Missing, expired, or invalid token.

403 Example

HTTP/1.1 403 Forbidden

Token is valid, but the user lacks the required role or permission.

Common Mistake

Do not return 403 just because the token is missing. Missing or invalid credentials should usually be 401 so clients know authentication is required.

Related

HTTP Status Codes

Browse related response codes.

HTTP Headers

Understand WWW-Authenticate and Authorization.

OAuth 2.0

Token flows that often produce 401 and 403 responses.

Knowledge is power.