diff --git a/CHANGELOG.md b/CHANGELOG.md
index 55298a78..240f33fa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## 4.2.1 (unreleased)
 - [PR #367](https://github.com/rqlite/rqlite/pull/367): Remove superflous leading space at CLI prompt.
+- [PR #368](https://github.com/rqlite/rqlite/pull/368): CLI displays clear error message when not authorized.
 
 ## 4.2.0 (October 19th 2017)
 - [PR #354](https://github.com/rqlite/rqlite/pull/354): Vendor Raft.
diff --git a/cmd/rqlite/main.go b/cmd/rqlite/main.go
index f9c7acbe..854c8c95 100644
--- a/cmd/rqlite/main.go
+++ b/cmd/rqlite/main.go
@@ -133,6 +133,10 @@ func sendRequest(ctx *cli.Context, urlStr string, line string, argv *argT, ret i
 		}
 		defer resp.Body.Close()
 
+		if resp.StatusCode == http.StatusUnauthorized {
+			return fmt.Errorf("unauthorized")
+		}
+
 		// Check for redirect.
 		if resp.StatusCode == http.StatusMovedPermanently {
 			nRedirect++
@@ -190,6 +194,10 @@ func cliJSON(ctx *cli.Context, cmd, line, url string, argv *argT) error {
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode == http.StatusUnauthorized {
+		return fmt.Errorf("unauthorized")
+	}
+
 	body, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err