Distinguish a 401 challenge from a 403 refusal

The useful distinctions

• 401 indicates missing or invalid authentication credentials.
• A 401 response includes WWW-Authenticate.
• 403 indicates that the server refuses the request.

Read the protocol evidence first

A response carrying a challenge tells a client which authentication mechanism the server is asking it to use. It does not disclose the correct credential or establish why a particular account lacks access. The synthetic response uses only a scheme name and a fictional realm. That is enough to illustrate the shape of a challenge without inserting a token, password, or usable account identifier into an article.

Keep account conclusions separate

A support note should preserve the status, challenge field, requested resource class, and collection time while redacting sensitive request data. A 403 observation belongs in a refusal branch, but it still does not identify a commercial reason such as an expired plan or unavailable channel. Those conclusions need evidence from the service that made the decision. Repeating the same rejected request in a loop does not provide that evidence. For a standards explanation, the useful boundary is what the response communicates and which next questions require authorized application context. No access workaround follows from the status distinction, and the example intentionally stops before any credential exchange. A challenge can be recorded as a protocol observation without collecting a password or token. The fictional realm label is descriptive context for the example, not an account name or an entitlement.

Worked example · synthetic

The response advertises a Bearer challenge without supplying a credential. A realm is an invented label here; it is not a login name or a token to reuse.

Synthetic text example; no network operation has been performed.

HTTP/MIME line endings are CRLF. Request URL context, where labelled, is commentary rather than a wire field. No message was transmitted.

HTTP/1.1 401 Unauthorized
Date: Sun, 08 Nov 2026 08:00:00 GMT
WWW-Authenticate: Bearer realm="synthetic-catalogue"
Content-Length: 0

Check the interpretation

• Expect a challenge with 401.
• Redact authorization and cookies from captures.
• Do not infer a subscription or account state from the code alone.