forbidden

HTTP 403 · The key is valid but is not allowed to do this.

What causes it

Either the key lacks a permission the route requires, or the key has an IP allowlist and your source address is not on it. **The API deliberately does not tell you which**, because saying so would tell an attacker which of the two tripped.

What to do

Check both. Confirm with Vaki which permissions your key carries, and whether it has an IP allowlist — a serverless platform with rotating egress addresses is the usual culprit for the second case.

Retry?

No — the same request produces the same answer.

The response

{
  "type": "https://developers.vaki.co/errors/forbidden",
  "title": "…",
  "status": 403,
  "code": "forbidden",
  "detail": "…",
  "instance": "/v1/checkout_links"
}

Branch on code, never on title or detail. The full list of codes, and the shape of the problem document, is on Errors.