# unauthorized

**HTTP 401 — Unauthorized**

## When you see it

The `Authorization` header is missing, malformed, expired, or names a credential this server does not know.

## What to do

Check the header is `Authorization: Bearer <token>`. If the token is an OAuth access token, refresh it. The `WWW-Authenticate` header on the response points at the authorization server.

## The response

Every error is [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) problem+json:

```json
{
  "type": "https://devs.inittasks.com/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "a sentence for a developer; never branch on it",
  "instance": "/todos/8E4F2A1B",
  "request_id": "3f9a1c7e-2b44-4d1e-9c30-5a7e8b2d1f60"
}
```

// Branch on `type`, never on `detail` or on the HTTP status alone — several codes share a status.