LINE error 401: Authentication failed

The status codes table defines 401 Unauthorized on the Messaging API in one sentence: "Valid channel access token is not specified." The body carries the templated string "Authentication failed due to the following reason: XXX", where LINE substitutes the specific reason - a malformed authorization header, an invalid token, an expired token, a revoked token. Whatever the substitution says, the class of problem is constant: the Authorization: Bearer {channel access token} header on this request did not authenticate against this channel.

LINE has several token types, and knowing which one you hold determines the fix. Channel access tokens v2.1 are issued against a JWT assertion with a lifetime you choose, up to 30 days, and a cap of 30 valid tokens per channel. Short-lived tokens last 30 days, same 30-token cap. Stateless tokens last 15 minutes and can be issued without limit. Long-lived tokens are issued from the LINE Developers Console. All of them die - by expiry, by explicit revocation, or by being crowded out during rotation - so a 401 in a system that "worked yesterday" almost always means a token aged out or was rotated without a redeploy.

Channel identity is the other big trap. A token authenticates one channel; user IDs, rich menu IDs, and webhook events are scoped to that same channel. Pasting a token from a different channel (or from a LINE Login channel of the same provider) produces 401s or, worse, Failed to send messages on IDs that don't exist in the token's channel. Never debug a 401 without first answering: which channel issued this token, and is that the channel this bot belongs to?

Unlike a rate-limit 429, retrying a 401 without changing credentials is pointless - the request will fail identically until the token is replaced. Fail fast, alert, and rotate.

HTTP/1.1 401 Unauthorized

{
  "message": "Authentication failed due to the following reason: invalid token. Confirm that the access token in the authorization header is valid"
}

Automate the token lifecycle: issue v2.1 or stateless tokens on a schedule, store them in a secrets manager keyed by channel and environment, and rotate with overlap (issue new, verify, switch, revoke old). Alert on the first 401 rather than the thousandth - authentication failures are binary, and every retried call is wasted. Keep per-channel labeling strict so a token can never be deployed against the wrong bot; see rate limits for the token-issuance ceilings that shape rotation design.