Comment by throwoutttt

403 is unauthorized (forbidden due to authorization policy).

401 is unauthenticated (not logged in).

Very important difference for clients handling authentication state.