Which HTTP response code is returned when a web server requires authentication to access a resource?

HTTP 500 Internal Server Error indicates an unexpected server-side failure during request processing, not an authentication requirement.

The HTTP 401 status code, defined in RFC 9110, explicitly signals that the request has not been applied because it lacks valid authentication credentials for the target resource. The server typically includes a WWW-Authenticate header in the 401 response to inform the client which authentication scheme is required. This is distinct from 403 Forbidden, where credentials may be present but access is still denied.

HTTP 302 Found is a redirect response that tells the client the resource has temporarily moved to a different URL, and is unrelated to authentication requirements.

HTTP 100 Continue is an informational status indicating the server has received the request headers and the client should proceed to send the request body, not an authentication challenge.