Forbidden

The server understood the request but refuses to authorize it.

403 Forbidden means the server knows who you are and has decided you're not allowed. Unlike 401, sending credentials won't help if those credentials simply lack permission. Common causes are missing roles or scopes, file permissions on the server, an IP block, or a WAF rule. Retrying the same request as-is won't change the outcome.

What 403 looks like on the wire

DELETE /api/projects/17 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error": "Deleting projects needs the admin role"}

About 4xx Client Error

The request has a problem the client needs to fix, like a bad URL, missing auth, or invalid input.

How to fix 403 Forbidden

Confirm the account or token actually has permission for this resource.
Check required scopes or roles on the API key.
On a static site, check file/directory permissions and index settings.
Rule out an IP block, firewall, or WAF rule rejecting the request.

Tools that help with 403

JWT Encoder/Decoder

Check the token's scope and role claims: a valid login that lacks permission is the classic 403.

Where it's defined

403 Forbidden is defined in RFC 9110 §15.5.4. MDN's 403 reference covers browser behavior and examples.

Looking for a different one? See the full HTTP status code reference.