Errors / forbidden

`forbidden`

403 This key may not do that

The key works, but it may not do this.

When it happens#

The key does not hold the scope the call needs. detail names it, such as this key does not hold the cloud:machines:exec scope.
The key was made for other work and holds no machine scope at all.
A key limited to some projects tried to make a project.
A key tried to give a new key a scope, a project or a rate it does not hold itself.
The account is held.

Use a key that holds the scope, or make one with a key that does: see Keys and scopes. For a held account, its owner can ask us why.

Send it again? Not with this key.

Every code, and how to read a refusal: Errors.