Status code

When you will meet it

When an AI tool fails, that number is your only clue. Confusing 401 with 429 sends you choosing between "swap the key" and "wait a moment" — and choosing wrong wastes an entire afternoon.

Minimal example

200 OK                    成功，回應內文就是你要的東西
400 Bad Request           請求本身寫錯了（JSON 壞掉、缺欄位、參數不對）
401 Unauthorized          身分沒過：金鑰錯、沒帶、或已過期  ← 最常被誤解
403 Forbidden             身分對了，但你沒權限做這件事（例如這把金鑰不能碰這個模型）
404 Not Found             網址路徑不對，或那個資源不存在
429 Too Many Requests     你送太快、撞到速率上限；Retry-After 會說多久後可重試
500 Internal Server Error 伺服器自己出錯了，不是你的錯；稍後重試或等它修好

Remember three and you are covered: 401 means your key/identity is wrong (check the Authorization header), 429 means you are too fast (wait, slow down, or back off), 500 means their side broke (not your fault; retry later). 401 vs 403: 401 is "we do not know who you are / you are not authenticated"; 403 is "we know who you are, but you may not do this".

What people get wrong

• Responding to a 401 by resending the exact same request. A 401 will not become a 200 no matter how many times you retry; it says your credentials are wrong — fix the key or the Authorization header instead.
• Treating 429 as a broken server and giving up. 429 just means "too fast" and is temporary; the right response is to honour Retry-After or retry with exponential backoff, not to bail out with an error.