A private API kept answering 401. That number means you did not prove who you are. Authentication is a header that carries a token the server checks.
About 1 min of reading
Send a credential header and turn a 401 into a 200.
Call a private endpoint with no credential. The server answers 401.
Before you run it, say out loud what it will print. Then open the answer.
Add the credential header from an environment variable. Now it answers 200.
Before you run it, say out loud what it will print. Then open the answer.
Authentication is a header that proves the caller. A Bearer token, an API key header, or a signed request are all just ways to fill that header. The server checks it before it does any work, and answers 401 if it is missing or bad.
A token typed on the command line is stored in shell history and often in logs. Read it from an environment variable or a file. This is not style, it is security: a leaked token is a leaked account.
401 Unauthorized401 does not mean you are wrong, it means you are unknown. The server is asking for proof. Add the credential header and try again.
curl -H 'Authorization: Bearer sk-abc123' https://api.example/usersThe Authorization header carries the token. The server checks it and, if valid, answers 200 with the data.
curl -H "Authorization: Bearer $TOKEN" https://api.example/usersRead the token from the environment, do not paste it in the command. A pasted secret lands in your shell history and your logs.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.