Skip to main content
err:frontline:client:insufficient_permissions
The API you called runs on Unkey, and it checks API keys. Your key is valid, but it doesn’t have the permissions or roles this route needs. You get 403 Forbidden. This isn’t err:unkey:authorization:insufficient_permissions, which is about a root key calling api.unkey.com.
Example response
Browsers get the same error as an HTML page.

If you’re calling an API hosted on Unkey

Changing the request won’t help. Ask the API owner to grant your key the permission or role this route needs, and give them the request ID.

If you own this API

The key’s permissions, whether granted directly or through its roles, don’t satisfy your key-auth policy’s permissionQuery. A key passes the gateway exactly when it would pass keys.verifyKey with the same query. A rejected request doesn’t spend credits. Common causes:
  • The key is missing the permission or role.
  • The permissionQuery is stricter than you meant.

How to fix

  1. Grant the missing permission or role to the key, or to its identity’s roles, in API Management. This applies on the next request.
  2. Or loosen the policy’s permissionQuery, then create a new deployment. Policy changes only apply to new deployments.
If the query doesn’t parse at all, callers get invalid_configuration instead.
Last modified on October 6, 2026