I'm a native speaker and I need to pause for a few hundred milliseconds just to be sure I'm using the right one in a sentence.
What does "unauthenticated" even mean here? You aren't logged in, not logged in isn't a state of "unauthenticated", you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense. You can have several sets of credentials and switch between them, not giving them any isn't being in an unauthenticated state its a different thing, and using "unauthorized" in that case makes sense.
That you're not logged in.
> You aren't logged in, not logged in isn't a state of "unauthenticated"
What? Yes it is.
> you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense
Ok? Yes, if you are unauthenticated (and authentication is required), then you are also unauthorized. However, the error code is not communicating that you are unauthorized; it is communicating that you need to authenticate, thus unauthenticated is more appropriate.
> You can have several sets of credentials and switch between them
Ok?
> not giving them any isn't being in an unauthenticated state its a different thing
That is exactly what being in an unauthenticated state means. What would you define to be an unauthenticated state otherwise?
A 403 means that it is simply forbidden. You cannot gain the authority to do what you want to do[2] and has nothing to do with credentials, no matter how nicely you ask.
For example, getting a project in your organization may return 401 (simply ask an admin for access), while getting a project in a different organization may return a 403 (you cannot get access to other organizations, ever).
1: https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized
2: https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden
Once you log in, you are granted authorization for certain tasks. This could be rights to an individual record or column, or it could be administrative privileges within an app. It's not involved in determining who you say you are; it authorizes you to access things based on who you are (from the act of authenticating).
That's the way I understand those two terms and their practical applications.
Like remembering when it's spelled "stationary" and when "stationery".
"Still" and "paper" are easier to remember.
Same problem when someone wants to substitute "login" for "authenticate" - not synonyms.
We give oranges and apples those distinct sounds, while giving blueberries and strawberries very similar names. It's just makes no sense that we should change the latter two so no one mixes them up trying to sprinkle some on yogurt.