Building json APIs with status code 401

“401 Unauthorized” invokes a browser popup as it’s the default behaviour on almost every browser (that I know of). You can either return a non-401 status code, or change the Authorization header from Basic or Digest to something like Json.