403 — it knows who you are and says no
What is this error?
You are authenticated, but the rules say this identity may not do this thing. That is authorisation, not authentication.
Common Causes
- A database row-level security policy does not cover this action.
- The user lacks the required role.
- The record belongs to somebody else.
- A storage bucket is private and no policy grants read.
How to fix it (Check First)
- 1Which exact table/route/resource is being touched?
- 2Read the policy that should allow it. Does it cover this operation (select/insert/update/delete)?
- 3Is the role you expect actually attached to this user?
What NOT to do
- Do not disable row-level security to get past it. That exposes everyone's data.
- Do not grant the anon role write access to a private table.
Technical Details
Authorisation is evaluated after identity is established. In Postgres with RLS, each statement is filtered by policies per operation; a missing policy is an implicit deny.