HTTP 401 Unauthorized: Meaning and Fix

401 Unauthorized

Meaning	The request is missing valid authentication.
When	No Authorization header, a bad token, or an expired session.
Causes	A missing API key, a rotated key, or a logged-out user.
Fix	Send valid credentials. Trigv returns 401 when the API key is missing or unknown.
Retry	Retry after refreshing the credential, not in a tight loop.
Alert?	Usually no. Alert if a key that used to work starts getting 401, because it was revoked or rotated.

Runs in your browser. Nothing you enter is stored.

Most 401s are not an incident

Alert if a key that used to work starts getting 401, because it was revoked or rotated.

curl -sS -X POST https://api.trigv.com/v1/events \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $TRIGV_API_KEY" \
  -d '{"channel":"ops","title":"HTTP 401","level":"warning"}'

Get an API key All status codes

How to use it

Read what 401 means before changing a retry loop.
Check the common causes against the response body and the server log.
Follow the retry note. Retrying a 400 with the same body will fail again.
Alert only in the cases the verdict describes.

About this tool

HTTP 401 Unauthorized means The request is missing valid authentication. Servers send it when No Authorization header, a bad token, or an expired session.

Common causes: A missing API key, a rotated key, or a logged-out user. The practical fix is: Send valid credentials. Trigv returns 401 when the API key is missing or unknown.

Retry: Retry after refreshing the credential, not in a tight loop.

Alert on it? Usually no. Alert if a key that used to work starts getting 401, because it was revoked or rotated.

Trigv is a push for the moment a status starts mattering, not a log of every response. If the code is one you should hear about, the snippet posts a single event with level error or warning. The status page itself does not call your API.

Questions

What is HTTP 401?

The request is missing valid authentication.

Should the client retry?

Retry after refreshing the credential, not in a tight loop.

Should I alert on it?

Usually no. Alert if a key that used to work starts getting 401, because it was revoked or rotated.

How is this different from reading the spec?

The page adds a plain retry note and an alert verdict for people running the service, not only for people parsing the response.

400 Bad Request The server could not understand the request. 403 Forbidden The server understood the request and refuses it. 404 Not Found The server has no resource at this URL. Cron Job Alert Script Wrap a command so a failed, slow, or finished cron job sends a Trigv alert.

HTTP 401 Unauthorized