401 Unauthorized Error: the Site Asks You to Sign In

What the error means

The 401 code means authentication is required to access the resource, and the request has no valid credentials. According to the HTTP standard (RFC 9110), together with 401 the server sends a WWW-Authenticate header that specifies how exactly to authenticate.

The main thing is not to confuse 401 with 407. The 407 code is sent by the proxy when it did not accept the proxy username and password, and it comes with a Proxy-Authenticate header. The 401 code is sent by the site: the proxy has already let you through, and the request reached its destination.

Causes

• The token or session has expired. Access tokens live for a limited time; after that, the site or API answers 401.
• The API key was not sent or was sent in the wrong place. The key is in the wrong header, the header name has a typo, or there is an extra space.
• The Authorization header was lost during a redirect. Some libraries remove it when a redirect leads to another domain. Python requests, for example, does this.
• Proxy credentials were put into site credentials. The proxy username and password ended up in Authorization instead of the proxy settings.
• The site reset the session after the address changed. Some sites ask you to sign in again when requests from one session come from different IPs.

How to fix it

1. Check who answered: if the code is 407, the question is about the proxy credentials, see the 407 page. If it is 401, look for the cause in the site sign-in credentials.
2. Get a new token or sign in to the site account again.
3. Check the header name and key format against the documentation of the API you use.
4. Keep the proxy credentials in the program's proxy settings and the site credentials in the request headers. An example of the correct split is in the Python requests guide.
5. If the site ties the session to the address, work within one session with a sticky IP: ports 10000-20000 keep one IP for 1 to 120 minutes.

How to check that it works

Run the same request without the proxy with the same sign-in credentials. If you also get 401 without the proxy, the problem is in the token or key. If everything works without the proxy, compare the headers of both requests and see whether the IP changed in the middle of the session.

Two-minute diagnosis

First paste the line into the proxy checker. If the proxy works there, the cause is in your app or its settings. If not, test the line from a terminal:

curl -v -x "http://USERNAME:PASSWORD@gw.prokso.com:823" https://api.ipify.org

• A < HTTP/1.1 407 line right after CONNECT means the proxy answered. The name after the code, for example NO_USER, points to the cause.
• The proxy answered CONNECT with 200 and then another code arrived - the proxy works, and that answer came from the website.
• No answer at all, only a timeout - the connection never reached the proxy: check the host, port and network.