A 403 Forbidden response from the Workshop public API can come from either Workshop permissions or Cloudflare, which protects the API before a request reaches Workshop. Check which service returned the response before changing an API key.
Identify the response
Workshop API error: a JSON response with an
error.code, such aspermission_denied, and arequest_id. Check that the key has the required scope and access to the intended business.Cloudflare rejection: a Cloudflare error page or response containing a Cloudflare Ray ID, rather than Workshop’s normal JSON error. The request may have been blocked before Workshop checked the key.
A valid key can still receive a Cloudflare 403. Rotating the key alone will not resolve a request that Cloudflare blocks before it reaches the API.
Check forwarded headers
We have confirmed a case where a Cloudflare rule blocked public API requests containing X-Original-Url or X-Rewrite-Url. Check whether your integration, HTTP client or hosting proxy sends either header.
If you control the headers and either is present, remove it and retry the request with your current valid API key.
If your runtime or proxy adds the header automatically and you cannot remove it, tell Bikebook Support which platform you use and which header it adds.
This does not mean every request from that platform is blocked. Support needs the details of the failing request to assess it.
What to send Support
The request method and URL, with sensitive query values removed.
The approximate request time and timezone.
The HTTP status and Cloudflare Ray ID, if present.
The API
request_idandX-Bikebook-Trace-Idresponse header, if Workshop returned them.Your integration or hosting platform, and whether either forwarding header is present.
A redacted error response or screenshot.
Do not send the API key, Authorization header, cookies or unredacted request logs. If Cloudflare blocked the request before Workshop received it, there may be no Workshop request ID.