Direct answer
A 401 response proves that the RTSP server answered but rejected the supplied authentication. Verify the camera-specific streaming account first, then test the same URL without embedding credentials and let the client answer the authentication challenge.
Why this happens
The common causes are a cloud-account login used instead of a local camera account, a password changed after the URL was saved, reserved characters breaking URI parsing, or a client and camera disagreeing about Basic or Digest authentication.
Start from the exact status code or network symptom, then change one layer at a time.
A controlled test
Use one known-good local client and the camera manufacturer’s documented path. Record whether the failure occurs on DESCRIBE or later, because an accepted login followed by another error is a different problem.
Change one variable at a time. Keep the camera model, firmware, endpoint and account recorded; then test network reachability, protocol response, media transport and decoding as separate layers.
Use a dedicated view-only account and a trusted local diagnostic tool. Redact credentials, private addresses and identifying data before sharing output.
Diagnostic sequence
| Check | Action | Evidence of progress |
|---|---|---|
| Account | Create or reset a dedicated local view-only account. | The same account opens the documented stream in one trusted client. |
| URL | Remove embedded credentials and enter them in separate fields. | The host and path remain unchanged and the client prompts correctly. |
| Challenge | Inspect whether the camera offers Basic, Digest or both. | The client selects a method the camera actually supports. |
| Cache | Delete the saved camera and add it again after a password change. | No old credential remains in the connection profile. |
Evidence to keep
Keep a short record of the exact endpoint, account type, authentication challenge and final result. That evidence distinguishes a real credential failure from a path, codec or transport issue.
Boundary and safety note
Do not weaken the camera account, reuse an administrator password or publish a working URL to make the test easier.
For remote viewing, use a managed VPN instead of exposing RTSP or camera administration ports directly to the public internet.
SmartRTSP
SmartRTSP is a camera-focused RTSP and ONVIF viewer for Apple devices, Windows and Android. It fits direct viewing, discovery and multi-camera checks; keep a dedicated NVR or VMS when continuous recording, evidence export or centralized enterprise controls are required.
Frequently asked questions
Does 401 mean the camera is offline?
No. The server was reachable and returned an authentication error.
Should credentials be placed in the RTSP URL?
Prefer separate username and password fields when the client offers them, especially when the password contains reserved URI characters.
Why does VLC work while another viewer returns 401?
The clients may parse embedded credentials differently or support different authentication challenges; compare the actual account and challenge before blaming the stream.
Primary references
- IETF RFC 7826 — Real-Time Streaming Protocol 2.0
- IETF RFC 3986 — URI generic syntax
- SmartRTSP — official platform and product information
Related SmartRTSP guide
Open related guideA layer-by-layer way to separate the camera account, URL parsing and authentication method when an RTSP stream returns 401.