Skip to content
AI Dev Toolkit.
Esc
  • Loading…

Claude Code · Sign-in

API Error: 403 Request not allowed

Claude Code’s “API Error: 403 Request not allowed” after login means your account isn’t allowed to use Claude Code yet. Check the plan, role and proxy.

Message

The exact error

Claude Code
API Error: 403 Request not allowed

Also appears as:

Raw API body, with the sign-in hint
API Error: 403 {"error":{"type":"forbidden","message":"Request not allowed"}} · Please run /login

Meaning

What does “403 Request not allowed” mean?

A 403 means the API knows who you are but refuses the request. That’s different from a 401, where the credential itself is rejected. Anthropic’s troubleshooting guide lists three reasons for this message after a successful login: the Claude subscription isn’t active, a Console account doesn’t have a role that includes Claude Code, or a corporate proxy is interfering with the request. Because the login itself worked, running /login again rarely helps until the account side is fixed.

Causes

Why do I get a 403 right after logging in?

  • Your Pro or Max subscription isn’t active, for example after a failed payment or a cancelled plan
  • On an Anthropic Console (API) account, your member role isn’t “Claude Code” or “Developer”
  • A corporate proxy or network filter answering for the API
  • A saved login that didn’t record your plan; in GitHub issue #8747 the stored credentials showed no subscription type after login

Fix

How do I fix “API Error: 403 Request not allowed”?

  1. Pro or Max: check the subscription is active

    Open claude.ai/settings and confirm the plan shows as active. If you upgraded or renewed recently, sign out and back in so Claude Code picks up the change.

    In Claude Code
    /logout
/login

  2. Console accounts: get the right role

    Ask an admin to give you the “Claude Code” or “Developer” role on the Console’s Members page at platform.claude.com/settings/members, then run /login again.

  3. Check which credential is active

    Run /status. If it shows an API key or a gateway you didn’t expect, that credential is the one being refused. See Invalid API key for how environment keys take priority over your login, and test a key on its own with the API key checker.

  4. Behind a proxy, test the network

    Corporate proxies can block or rewrite API requests. Set HTTPS_PROXY to your company proxy and see Unable to connect to API for the connectivity checks.

Explained

Is every Claude Code 403 the same error?

No. The text after 403 tells them apart. curl: (22) The requested URL returned error: 403 during install comes from the download server and usually means a proxy or a country where Claude Code isn’t offered; see Install script returns HTML. On Amazon Bedrock, Google Cloud and Microsoft Foundry, a 403 arrives as “AWS authentication failed”, “Google Cloud authentication failed” or “Microsoft Foundry authentication failed”, and the fix is cloud permissions or model access, not /login. A Claude apps gateway reports “Gateway refused the request”, which only its administrator can change.

FAQ

Questions people ask

Why does Claude Code say 403 Request not allowed when I have a Pro plan?

The API refused the request for your account even though sign-in worked. Check that the subscription is active at claude.ai/settings, then run /logout and /login so the saved login reflects your plan. If /status shows an API key instead of your subscription, that key is being refused.

Does running /login fix a 403 error?

Only when the saved login is stale, for example after an upgrade or renewal. If the subscription is inactive, your Console role lacks Claude Code access or a proxy is blocking the request, signing in again gives the same 403. Fix the account or network first, then sign in.

What role does a Console account need for Claude Code?

Anthropic’s troubleshooting guide says the account needs the “Claude Code” or “Developer” role. An organisation admin assigns it on the Members page of the Claude Console. After the change, run /login again so Claude Code uses the updated permissions.

Is a 403 the same as a 401 in Claude Code?

No. A 401 means the credential was rejected: it was revoked, expired or belongs to a deactivated account. A 403 means the credential was accepted but isn’t allowed to make this request, usually because of the plan, the role or something on the network in between.

Related

Related errors

Search all Claude Code errors

Keep exploring