Forbidden

4xx Client Error

Last updated: August 3, 2026

The server understood the request and the client is authenticated, but access is refused.

Description

Authorization failure. The client is authenticated, but does not have permission for this specific resource or action. Repeating the request will not help.

When to use

Return 403 when a valid user tries to access a resource they don't own or perform an action their role doesn't allow.

Common pitfalls

Some APIs return 404 instead of 403 to hide the existence of protected resources — an intentional trade-off for security.

Also searched as

Developers commonly search for 403 using phrases like 403 forbidden · 403 error · http 403 · 403 vs 401 · 403 forbidden meaning · 403 status code. All refer to the same HTTP 403 Forbidden response.

Specification

RFC 9110 §15.5.4

Examples

HTTP response

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error":"Forbidden"}

Node.js (Express)

res.status(403).json({ error: "Forbidden" });

Go (net/http)

w.WriteHeader(http.StatusForbidden)

Python (Flask)

return jsonify({"error": "Forbidden"}), 403

Debug 403 with these tools

JWT Decoder →Inspect the token your API is rejecting — check exp, aud, iss.JWT Verifier →Verify the signature against the expected public key.JWT Generator →Craft a fresh test token with the right claims.Base64 Encoder →Build a proper `Authorization: Basic user:pass` header value.

Related status codes

401

Unauthorized

Authentication is required and has not been provided, or provided credentials are invalid.

404

Not Found

The server has not found anything matching the requested URL.