HTTP 401 Unauthorized — find the cause locally

Paste the failing request and response (headers + body as copied from DevTools) — the debugger surfaces what the data already knows: missing headers, expired tokens, server demands. Nothing is uploaded.

What does 401 actually mean?

401 Unauthorized means: the server could not authenticate you. It is about who you are, not what you may do (that is 403). Almost every 401 is one of these:

1. No credentials sent — the Authorization header is missing entirely (typo, missing interceptor, CORS pre-flight stripping it).
2. Expired token — JWT exp passed; refresh or re-authenticate.
3. Wrong scheme — Bearer vs Basic vs custom; scheme spelling and casing matter to strict servers.
4. Clock skew — your iat/nbf vs server time differ by minutes; some validators reject.
5. Wrong audience / issuer — a valid token, but issued for a different API.

Is my data uploaded anywhere?

No. This page is a single static HTML file — analysis runs entirely in your browser, including the token patterns. Disconnect from the internet after it loads.

Need the full toolbox?

This page is one tool from LocalDevToolbox — 15+ local developer tools: JWT decoder, context optimizer, stack trace analyzer, log doctor and more.