4xx Client errors

401 Unauthorized

Authentication is missing or invalid: no login, an expired session or a wrong API token.

Common causes

Calling an API without a token, or with an expired or mistyped one.
A session that expired.
An Authorization header that the server strips (some Apache setups drop it).

How to fix a 401 error

1
Send Authorization: Bearer <token> and check the token is still valid.
2
On Apache / cPanel, keep the RewriteRule in Laravel's public/.htaccess that passes the Authorization header through.
3
Log in again to start a fresh session.

Search error fixes for 401

In Laravel

Sanctum and the auth middleware return 401 for unauthenticated API requests (and redirect web requests to the login page).

Check the status of a URL

The first line of the response shows the status code; -L follows redirects and shows each step.

curl -I https://example.com/page
curl -IL https://example.com/old-page

Frequently asked questions

What does HTTP 401 mean?

Authentication is missing or invalid: no login, an expired session or a wrong API token.

How do I fix a 401 error?

Send Authorization: Bearer <token> and check the token is still valid. On Apache / cPanel, keep the RewriteRule in Laravel's public/.htaccess that passes the Authorization header through. Log in again to start a fresh session.

How does Laravel handle 401?

Sanctum and the auth middleware return 401 for unauthenticated API requests (and redirect web requests to the login page).