HTTP Status Codes Error 401: Unauthorized

Identify: does your log match?

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"
Content-Type: application/json

{"error":"invalid_token","error_description":"The access token expired"}

1. High

   Expired access token

   Short-lived JWTs (often 5–60 min) expire while the client keeps using them. The server answers 401 with error="invalid_token".

2. Medium

   Authorization header stripped

   A redirect to another host, a proxy or a CORS preflight drops the Authorization header, so the server sees an anonymous request.

3. Medium

   Wrong scheme or format

   Sending the raw token without "Bearer ", using Basic for a Bearer API, or a stray newline in an env var.

Fix

const res = await fetch('/api/me', { headers: { Authorization: token } });

async function api(path: string, init: RequestInit = {}, retried = false): Promise<Response> {
  const res = await fetch(path, {
    ...init,
    headers: { ...init.headers, Authorization: `Bearer ${getAccessToken()}` },
  });
  if (res.status === 401 && !retried) {
    await refreshAccessToken();
    return api(path, init, true);
  }
  return res;
}

Verify: reproduce it on purpose

$ curl -i https://httpbin.org/bearer

Prevent

• Always return WWW-Authenticate with a 401.
• Refresh tokens proactively a minute before exp.
• Do not follow cross-origin redirects with credentials.