Discord error 40001: Unauthorized

The request carried no usable credentials. Either the Authorization header was missing, was empty, or used a scheme Discord did not recognize for that route. This is different from 50014 Invalid authentication token, which means a token was present and parsed but rejected. 40001 is "I did not get a token at all", and it is the code you see when an environment variable is undefined and your code sends Authorization: Bot undefined.

Bot tokens must be sent as Authorization: Bot <token>; OAuth2 access tokens as Authorization: Bearer <token>. Using the wrong prefix, or none, on a route that requires auth returns 40001. A handful of routes are unauthenticated (executing a webhook by URL, gateway bootstrap), so a correct token is not always needed, but when it is needed it must be well-formed.

Triage among the three token errors takes one minute. If REST returns 40001, the header is missing or malformed: no token arrived. If REST returns 50014, a token arrived and was rejected: it is wrong or revoked. If the gateway closes with 4004, the same bad-token condition hit the WebSocket. Seeing 40001 on some routes and success on others usually means the header is being dropped in one code path only, classically a fetch wrapper that whitelists headers, a proxy that strips Authorization, or a serverless function whose secret is mounted in one environment and not another. The literal string Bot undefined in a request log is the smoking gun for an unset environment variable.

{
  "message": "401: Unauthorized",
  "code": 0
}

// or, on many routes:
{
  "message": "Unauthorized. Provide a valid token and try again",
  "code": 40001
}

Fail fast at startup: assert the token is present and matches the expected shape before constructing the client. Add a readiness check that calls GET /users/@me once and refuses to boot on 401. Keep secrets in a manager, not in shell history or copied .env files.

If the bot also shows offline, work through the token checklist in Discord bot not responding; repeated 401s count toward the invalid-request ceiling described on the Discord limits page, so do not leave a misconfigured bot retrying overnight.