Overview

A 403 Forbidden error indicates that the API server understood your request but is refusing to authorize it. This typically happens when the request does not meet minimum security requirements or violates an access rule.

Common Causes

Missing or Empty User-Agent Header

Requests that do not include a User-Agent header may be blocked automatically by our edge security layer.

In addition, User-Agent corresponding to cybersecurity scanning tools, crawlers, automated bots or software known to perform passive or active analysis are not allowed.

These tools are blocked by security policies, even if the rest of the application is valid.

Check if the module you are using is automatically defining a valid User-Agent.

This helps identify your traffic as legitimate and avoids being blocked by our automated protection systems.

IP Address Restrictions

Your IP may have been temporarily or permanently blocked due to:

• Exceeding rate limits
• Suspicious behavior, including IP addresses that have been banned for malicious activity
• Originating from a restricted region or ASN

Missing or Invalid API Key

For authenticated endpoints, failing to provide a valid API key in the Authorization header will result in a 403 response.

Firewall or WAF Policies

Cloudflare and internal security policies may block access based on request patterns, lack of headers, or known malicious indicators.