Developer
Encoders, converters & dev utilities
403 Forbidden
HTTP 403 Forbidden. Authenticated (or authentication is irrelevant) but the request is not allowed — the client is identified yet lacks permission. Re-authenticating will not help. When to use it: Return when the caller is known but not permitted; contrast with 401, where the fix is to provide credentials. It is a client-error (4xx) status, which means the problem is with the request and the caller must change something before retrying. (Reference: RFC 9110 §15.5.4.)
Authenticated (or authentication is irrelevant) but the request is not allowed — the client is identified yet lacks permission. Re-authenticating will not help.
- When to use: Return when the caller is known but not permitted; contrast with 401, where the fix is to provide credentials.
- How to handle: Request the required permissions/role, or access a resource you are allowed to; re-sending credentials will not change the outcome.
- Reference: RFC 9110 §15.5.4
- Category: 4xx Client Error
Frequently asked questions
What does HTTP 403 mean?
HTTP 403 Forbidden: Authenticated (or authentication is irrelevant) but the request is not allowed — the client is identified yet lacks permission. Re-authenticating will not help. It is a client-error (4xx) status, which means the problem is with the request and the caller must change something before retrying. It is defined in RFC 9110 §15.5.4.
What is the difference between 403 and 401?
403 Forbidden means the server knows who you are but you are not allowed to perform this action — you need different permissions or a different resource, and re-authenticating changes nothing. 401 Unauthorized means you have not authenticated at all (missing or invalid credentials) and should provide valid ones. Return 403 when the caller is identified but unauthorised; return 401 when the fix is to supply credentials.