401 Unauthorized JSON response example

Last updated 2026-05-20

When to use this

Use this for "you are not logged in" — the request lacks valid credentials. Pair it with a WWW-Authenticate header so clients know which scheme to retry with.

Example JSON

Returned by any auth-protected endpoint when no/expired token is sent.

{
  "status": 401,
  "error": "Unauthorized",
  "message": "Authentication required",
  "code": "auth_required",
  "authenticateHint": "Bearer realm=\"api\""
}

Request examples

const res = await fetch('https://jsonexamples.com/http/401/Authentication+required');
if (!res.ok) {
  const err = await res.json();
  console.error(res.status, err.message);
}

curl -i https://jsonexamples.com/http/401/Authentication+required

import requests

r = requests.get('https://jsonexamples.com/http/401/Authentication+required')
if r.status_code >= 400:
    print(r.status_code, r.json())

Try the live endpoint

Click below to call /http/401/Authentication+required from your browser.

// click the button to populate this block

Common variations

Expired-token variant

{
  "status": 401,
  "error": "Unauthorized",
  "message": "Access token expired",
  "code": "token_expired"
}

Convert this JSON

Generated starting points for TypeScript, JSON Schema, and Zod. Refine before shipping to production.

export interface 401Unauthorized {
  "status": number;
  "error": string;
  "message": string;
  "code": string;
  "authenticateHint": string;
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "401Unauthorized",
  "type": "object",
  "properties": {
    "status": {
      "type": "integer"
    },
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    },
    "code": {
      "type": "string"
    },
    "authenticateHint": {
      "type": "string"
    }
  },
  "required": [
    "status",
    "error",
    "message",
    "code",
    "authenticateHint"
  ],
  "additionalProperties": false
}

import { z } from 'zod';

export const 401UnauthorizedSchema = z.object({
  status: z.number(),
  error: z.string(),
  message: z.string(),
  code: z.string(),
  authenticateHint: z.string()
});
export type 401Unauthorized = z.infer<typeof 401UnauthorizedSchema>;