401 vs 403 Status Codes

401 Unauthorized means the request does not have valid authentication credentials for the protected resource. The name is old and slightly confusing: it usually means “you are not authenticated here,” not “you are authenticated but unauthorized.” The response must include a WWW-Authenticate challenge that tells the client which authentication scheme applies.

403 Forbidden means the server understood the request but will not perform it. The most common API example is a user with a valid login who lacks the required role, ownership, tenant membership, or account state. HTTP does not require every 403 caller to be authenticated, so “logged in but not allowed” is a useful everyday rule, not the complete protocol definition.

Suppose GET /account arrives with no bearer token or with an expired token. The API returns 401 and a Bearer challenge; a new login or token may let the request pass. If a normal member calls GET /admin/audit-log with a valid token, the API returns 403 because that identity is not allowed to read the audit log. Supplying the same token again will not change that result.

There is one important security boundary. A server may return 404 Not Found instead of 403 when admitting that a protected resource exists would leak information. Whether it returns 403 or a concealed 404, the authorization check must still happen. Keep the public message safe, and never omit the required challenge from a 401 response.