forbidden

https://docs.getenvie.com/errors/forbidden · 403 — the credentials are valid, but the operation isn't available to them.

Envie has three auth modes with deliberately different powers: the app proxy (Liquid), public keys (headless browsers), and secret keys (servers). This error means the operation exists — for a different mode than yours.

Frequent causes

• Private endpoints with a public key. Everything outside /v1/storefront/* needs Authorization: Bearer env_sk_….
• Sharing an anonymous list. Share links exist for customer-owned lists only — a guest list is bound to one browser.

Fix

Move the call server-side with a secret key, or reconsider whether the storefront surface (/v1/storefront/*) already covers what you need.