REST API 401 Unauthorized
Can you post an exact curl request? Does the user in your request have permission to create content?

if basic auth is enabled then you need to add the user name and password to the request. For example curl request:

curl --include \
  --request POST \
  --user admin:admin \
  --header 'Content-type: application/hal+json' \
  https://ddj9.ply.st/node?_format=hal_json \
  --data-binary '{"_links":{"type":{"href":"http://ddj9.ply.st/rest/type/node/article"}},"title":[{"value":"Example node title"}],"type":[{"target_id":"article"}]}'


Otherwise If the user must be authenticated via cookie then:
 1. you have to send a post to login the user.

curl --header "Content-type: application/json" --request POST --data '{"name":"admin", "pass":"admin"}' http://drupal.d8/user/login?_format=json

The output will look like: 

{"current_user":{"uid":"1","roles":["authenticated","administrator"],"name":"admin"},"csrf_token":"wBr9ldleaUhmP4CgVh7PiyyxgNn_ig8GgAan9-Ul3Lg","logout_token":"tEulBvihW1SUkrnbCERWmK2jr1JEN_mRAQIdNNhhIDc"}



Retrive a token from the returned value result 
Do what you need to do. : 

// get X-CSRF-Token.
$url = 'your_url';
$json = '{
"name": "admin",
"pass": "PASSWORD"
}';
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, $json);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
 'Content-Type: application/json')
);
$result = curl_exec($ch);
$user = json_decode($result, TRUE);
$x_csrf_token = $user['csrf_token']
if ($x_csrf_token) {
    // do what you need  
 curl_setopt_array($curl, array(
  CURLOPT_URL =&gt; "http://www.xxxxxx.com/loyalty/node/?_format=json",
  CURLOPT_RETURNTRANSFER =&gt; TRUE,
  CURLOPT_ENCODING =&gt; "",
  CURLOPT_MAXREDIRS =&gt; 10,
  CURLOPT_TIMEOUT =&gt; 30,
  CURLOPT_HTTP_VERSION =&gt; CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST =&gt; "POST",
  CURLOPT_POSTFIELDS =&gt; $input,
  CURLOPT_HTTPHEADER =&gt; array(
   // if you need basic auth then uncomment the nextline
   // "authorization: Basic b64Value",
    "cache-control: no-cache",

    "x-csrf-token: $x_csrf_token"
  ),
));
$response = curl_exec($curl);