Encountered HTTP 401 with error ${data.code}: ${data.message

Error message

Encountered HTTP 401 with error ${data.code}: ${data.message}. Your token will be removed from this REST instance. If you are using @discordjs/rest directly, consider adding 'auth: false' to the request. Open an issue with your library if not.

What it means

This is not a thrown exception but an emitted warning (process.emitWarning or console.warn) when Discord responds HTTP 401 with a non-zero error code on an authenticated request. The REST manager then nulls its token, since the token is definitively invalid, and warns library authors that their library is forwarding an invalid token.

Source

Thrown at packages/rest/src/lib/handlers/Shared.ts:197

		// We are out of retries, throw an error
		throw new HTTPError(status, res.statusText, method, url, requestData);
	} else {
		// Handle possible malformed requests
		if (status >= 400 && status < 500) {
			// The request will not succeed for some reason, parse the error returned from the api
			const data = (await parseResponse(res)) as DiscordErrorData | OAuthErrorData;
			const isDiscordError = 'code' in data;

			// If we receive this status code, it means the token we had is no longer valid.
			if (status === 401 && requestData.auth === true) {
				if (isDiscordError && data.code !== 0 && !authFalseWarningEmitted) {
					const errorText = `Encountered HTTP 401 with error ${data.code}: ${data.message}. Your token will be removed from this REST instance. If you are using @discordjs/rest directly, consider adding 'auth: false' to the request. Open an issue with your library if not.`;
					// Use emitWarning if possible, probably not available in edge / web
					if (typeof globalThis.process !== 'undefined' && typeof globalThis.process.emitWarning === 'function') {
						globalThis.process.emitWarning(errorText);
					} else {
						console.warn(errorText);
					}

					authFalseWarningEmitted = true;
				}

				manager.setToken(null!);
			}

			// throw the API error
			throw new DiscordAPIError(data, isDiscordError ? data.code : data.error, status, method, url, requestData);
		}

		return res;
	}
}

View on GitHub (pinned to a81ed8a306)

Solutions

Regenerate and correctly configure a valid bot token, then restart the application
Check the token string for stray whitespace, quotes, or a 'Bot ' prefix mistake
Verify the token is a bot token (from the Developer Portal Bot page), not a client secret
If intentionally making unauthenticated requests, pass auth: false in the request options
After this warning the REST instance token is cleared — re-create/re-authenticate the manager to continue authenticated calls

Example fix

// before
await rest.get(Routes.user('@me')); // 401: invalid token
// after
const token = process.env.DISCORD_TOKEN?.trim();
if (!token) throw new Error('DISCORD_TOKEN is missing');
const rest = new REST().setToken(token);
await rest.get(Routes.user('@me'));

Defensive patterns

Strategy: try-catch

Validate before calling

const token = process.env.DISCORD_TOKEN?.trim();
if (!token || !/^Bot\s|^[A-Za-z0-9_-]{20,}/.test(token)) {
  throw new Error('DISCORD_TOKEN looks invalid; regenerate it in the Developer Portal');
}

Type guard

function looksLikeBotToken(t: string | undefined): t is string {
  return typeof t === 'string' && t.length >= 50 && !t.includes(' ');
}

Try / catch

process.on('warning', (w) => {
  if (w.message?.includes('Encountered HTTP 401')) {
    console.error('Discord rejected the bot token; re-authenticate the REST instance');
  }
});

Prevention

Trim and validate the token read from environment/config
Use auth: false for requests that do not need authentication
Alert on HTTP 401 responses so a rotated/reset token is detected immediately
Remember the manager clears its token after this warning — plan for re-initialization

When it happens

Trigger: Any authenticated request receiving 401 Unauthorized from Discord with a Discord error code — invalid, reset, or revoked bot token being used.

Common situations: Token regenerated in the Discord Developer Portal while the bot runs; DISCORD_TOKEN containing whitespace/quotes from .env parsing; accidentally using a user token or a client secret instead of a bot token; token leaked and reset by Discord.

Understand the failure class

HTTP status errors: handling 4xx and 5xx responses — how to handle 4xx and 5xx responses properly.

Related errors

AI-assisted analysis of discordjs/discord.js@a81ed8a306 (2026-08-30). Data as JSON: /api/errors/65b10a57ef62e56b. Report an issue: GitHub.