HTTP 401 means the server is reachable but requires valid authentication for the requested resource. Uptime Basics treats 401 as a failed check unless the monitor supplies valid Basic Authentication or you intentionally accept 401 as a healthy response.
A new monitor that returns an unaccepted 401 cannot pass initial validation. An existing monitor can begin returning 401 after credentials, access policy, or the target application changes.
Decide what the monitor should verify
Choose one of these approaches:
- Monitor the protected content: configure supported Basic Authentication so the endpoint returns its normal success response.
- Monitor a dedicated health endpoint: create a public or safely header-protected GET endpoint designed for automated monitoring.
- Monitor only the authentication boundary: accept 401 when the challenge itself is the intended healthy result.
The third option proves that the authentication layer responds. It does not prove that a user can successfully sign in or that the protected application works after authentication.
Configure Basic Authentication
Uptime Basics supports standard HTTP Basic Authentication. It does not complete interactive sign-in forms, run browser JavaScript, maintain a user session, solve a challenge, or perform OAuth/OpenID Connect login flows.
- Open the monitor.
- Open Monitor Tools and Advanced Request Options.
- Set Authentication to Basic authentication.
- Enter the username and password issued for the monitoring endpoint.
- Save the settings.
Use a dedicated least-privilege monitoring credential where possible. It should have only the access needed to request the health endpoint.
Saved Basic Authentication credentials are encrypted and are not returned in plaintext after saving. Do not put credentials into the monitored URL, monitor name, or other display fields.
If the endpoint uses another authentication method
Custom Authorization, Proxy-Authorization, Cookie, and Host headers are blocked from the custom-header list. Do not paste bearer tokens or session cookies into the URL.
For an application that requires OAuth, a login form, short-lived tokens, or browser sessions, create a dedicated health endpoint. It can use a separate non-Authorization header such as a purpose-specific monitor key if that fits your security design.
Up to 10 custom request headers can be saved. Treat every header value as a secret when it grants access, rotate it when staff or systems change, and avoid reusing a high-privilege application credential.
Should you accept HTTP 401?
Add 401 to Accepted HTTP status codes only when an unauthenticated 401 is the documented healthy behavior you want to monitor.
For example, an API root can intentionally require authentication and consistently return 401 while the gateway is healthy. Accepting 401 can monitor that public boundary, but it cannot confirm authorized API requests succeed.
Once accepted, a 401 response counts as Up and no authentication failure is recorded for that check. Prefer a dedicated health endpoint when you need stronger evidence.
Troubleshoot unexpected 401 responses
- Confirm the username and password are current.
- Confirm the endpoint uses HTTP Basic Authentication rather than a web form or token exchange.
- Check whether the account is locked, disabled, expired, or restricted by source location.
- Verify that a redirect does not send the request to a different hostname or login system.
- Check the application and gateway logs at the failed timestamps.
- Confirm a password rotation was also saved in the monitor.
Do not repeatedly submit an account's normal administrator credentials. Use a dedicated monitor identity with minimal permissions.
When to contact Support
Contact Support if a supported Basic Authentication endpoint returns a success response using the same credentials outside Uptime Basics but continues to return 401 to the monitor.
Include the monitor name, URL, timestamps, request method, and authentication type. Never send the password, bearer token, session cookie, verification code, or complete authorization header.