unauthorized

HTTP 401 — Unauthorized

When you see it

The Authorization header is missing, malformed, expired, or names a credential this server does not know.

What to do

Check the header is Authorization: Bearer <token>. If the token is an OAuth access token, refresh it. The WWW-Authenticate header on the response points at the authorization server.

The response

Every error is RFC 9457 problem+json:

{
  "type": "https://devs.inittasks.com/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "a sentence for a developer; never branch on it",
  "instance": "/todos/8E4F2A1B",
  "request_id": "3f9a1c7e-2b44-4d1e-9c30-5a7e8b2d1f60"
}

Branch on type, never on detail or on the HTTP status alone — several codes share a status.