When to Use 401 vs 403
401 Unauthorized means the request is missing valid authentication. The client should send credentials (or a better token) and try again. The WWW-Authenticate header often accompanies it. You were not identified, or the identification failed.
403 Forbidden means the server understood who you are and still will not let you in. Retrying with the same identity will not help. Typical cases: a user hitting an admin-only route, an API key that is valid but scoped to a different tenant, or a resource the user must not even confirm exists (though many APIs use 404 for that).
If you are building an API: return 401 when there is no session or the token is expired. Return 403 when the session is valid and authorization failed. Search our HTTP status reference for neighboring codes like 404 and 429.
Tips
- A logged-out user hitting /admin should get 401, not 403 — they have not authenticated yet.
- A logged-in user hitting /admin without the admin role should get 403.
- Do not use 401 for "this account is banned" if they authenticated successfully — that is 403.
- Some security guides recommend 404 instead of 403 so you do not leak that a resource exists.