What 403 means
Unlike 401, authenticating again won't help: your account or key lacks permission, or the request is blocked (by IP, region, bot protection or a firewall).
Common causes
- Your API key doesn't have the required scope or plan.
- Your IP or country is blocked, or the request was flagged as a bot.
- You're trying to access another user's resource.
How to fix it
If you're calling an API
- Check the key's scopes and permissions in the provider's dashboard.
- Send a realistic User-Agent; some APIs block requests without one.
- If it works from your laptop but not your server, the server's IP range may be blocked.
If you run the server
- Say why access was denied in the body. Use 404 instead if revealing that the resource exists is a risk.
Should you retry?
No, unless the permissions or block change.
Example response
HTTP/1.1 403 Forbidden
Content-Type: application/problem+json
{
"type": "about:blank",
"title": "Forbidden",
"status": 403,
"detail": "The server knows who you are, but you're not allowed to do this."
}Defined in: RFC 9110 (HTTP Semantics). 403 is a client error: change the request before retrying.
Debugging an API call? Convert your request with the cURL converter, check the response with the JSON formatter, or decode your token with the JWT decoder.