403 Forbidden

What does 403 Forbidden mean?

The server understood the request and knows who you are, but refuses to authorise it. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.

When do APIs return 403?

Authentication succeeded but the account lacks permission, the API key is missing a scope, or an IP allowlist or WAF rule blocked you.

How to fix a 403 Forbidden

This is a permissions problem, not a credentials problem — sending a fresh token will not help if the token lacks the required scope. Check the scopes attached to your key, the role of the authenticated user, and whether a firewall or geo rule is intercepting the request before it reaches the application.

Reproduce a 403 response

The fastest way to understand a status code is to trigger one and read the full response. Open the API tester and send a request to https://httpbin.org/status/403 — you will see the 403 status along with every response header the server sent. Comparing those headers against a working request is often what reveals the cause.

When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.

Related 4xx status codes