A client sends a request to an API endpoint without providing any authentication credentials at all, and the server requires authentication to access this resource. Which HTTP status code should the server return?

401 Unauthorized specifically indicates that the request lacks valid authentication credentials for the target resource — the client needs to authenticate (e.g., provide a valid API key, token, or login) before the request can be processed. This is distinct from 403 Forbidden, which indicates the client IS authenticated (its identity is known) but does not have permission to access this particular resource regardless of credentials. Since no credentials were provided at all in this scenario, 401 is the semantically correct response, prompting the client to authenticate.