Skip to main content
2026-07-29 16:01
REST API

401 Unauthorized

ErrorAuthValidateEasy
Try Interactive Demo

What you will learn

  • Distinguish 401 Unauthenticated (prove who you are) from 403 Forbidden (you are you, but no) — wrong code confuses clients
  • Include WWW-Authenticate header on 401 — spec-compliance matters for some automated tools
  • Do not reveal whether the account exists — 401 for both wrong-password and unknown-user avoids enumeration

Description

Handle missing or invalid authentication.

Test Scenario

const response = await request.get('/api/v1/auth/me');
// No auth header
expect(response.status()).toBe(401);
Endpoint/api/v1/errors/401

Testing Tips

  • •Request without auth header
  • •Request with invalid token
  • •Check WWW-Authenticate header
// Playwright - 401 Unauthorized
import { test, expect } from '@playwright/test';


test('401 for missing auth', async ({ request }) => {
  const response = await request.get('/api/v1/auth/me');
  expect(response.status()).toBe(401);


  const body = await response.json();
  expect(body.error.code).toBe('UNAUTHORIZED');
});

Challenge ID: rest-error-401

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/errors/401

Press Enter to send