What is the difference between codes 401 Unauthorized and 403 Forbidden?

HTTP status code 401 Unauthorized means that the request requires authentication — the user is not authorized or has not provided valid credentials. The server indicates that login is required.

Status code 403 Forbidden means that the server understood the request and authentication was successful, but the user does not have permission to access the requested resource. That is, access is denied regardless of authentication.

Example:

• 401 — the user is not logged in or the token has expired.
• 403 — the user is logged in but tries to access someone else's data or a forbidden page.