API access denied (403)

A 403 response means your credential was recognized but is not allowed to make this request. The most common causes are using a publishable key, calling from a website origin the key does not allow, or an organization on the Free plan. Check error.code in the response and find it below.

Codes and fixes

Code	Message	Fix
public_key_rejected	”A publishable key cannot call this endpoint. Use a secret API key.”	Call the API from your server with a secret sk_live_ key. Keep secret keys out of browsers and mobile apps.
origin_not_allowed	”This API key is not allowed to be used from this origin.”	The key has a list of allowed origins. Add the exact origin (scheme, host and port) to the key’s list in the Console. Server-side calls send no origin, so use a key without an origin list for them.
plan_required	”API access requires a paid plan.”	The organization is on the Free plan, or its billing is inactive. Upgrade, or update the payment method.
insufficient_scope	”This credential does not have the scope this request needs.”	The credential lacks a needed permission. Use a secret API key, or ask for the right scope when signing in.
org_membership_required	”The credential owner is not an active member of its organization.”	The person who created the key left the organization. Create a new key owned by a current member.
account_disabled	”This account is disabled.”	See Account disabled or deleted.
org_unavailable	”The organization this credential belongs to is not available.”	The organization is suspended or being deleted. An owner should check billing notices or contact support.
forbidden	”This credential is not allowed to perform this request.”	Check that the key belongs to the right organization and has access to this endpoint.

Publishable versus secret keys

Key	Starts with	Can call the API?
Secret key	sk_live_	Yes, from your server.
Publishable key	pk_live_	No. Calls to the API are refused with public_key_rejected.

Do not retry unchanged

A 403 will not change on retry. Fix the key, origin, plan or membership first.

Related

• API key errors (401)
• Create an API key
• Error codes reference