What is the difference between 401 Unauthorized and 403 Forbidden?
Quick Answer
401 means “you're not authenticated” — no credentials, or invalid/expired ones. The response includes a WWW-Authenticate header, and the client should authenticate and retry. 403 means “you are authenticated, but you're not allowed to do this” — re-authenticating won't help.
401 is about authentication — the request has no credentials or bad ones, so the client needs to log in and try again, and the response tells it how with a WWW-Authenticate header. 403 is about authorization — the client is properly authenticated, we know who they are, but they don't have permission for this action, so retrying with the same identity is pointless. The naming is confusing because 401 is called “Unauthorized” even though it means unauthenticated.
- Naming quirk: 401 is literally named “Unauthorized” but it's really about authentication.
- Missing token → 401. Expired token → 401. Valid token, wrong role → 403.
- Some APIs return 404 instead of 403 to avoid revealing that a resource exists.
- ASP.NET Core: authentication failure produces 401 (with a challenge), authorization failure produces 403.