# forbidden

This credential is not allowed to do that.

## What it means

The key is valid, but this action is not allowed for it. Most often it is a test key doing something only a live key may do.

## Why it happens

- A test key tried to create a live key, rotate the signing secret, or change an app that already serves live domains. Test keys are sandboxed so a leaked one cannot touch production.

## What to do

1. Use a live key, or make the change in the dashboard.
2. Keep test keys for development and CI; see [Test mode](/docs/guides/test-mode) for what they can do.

- [Open the dashboard](/app/domains)
- [All limits](/docs/limits-and-pricing)

## In the API

```
HTTP 403

{
  "error": {
    "code": "forbidden",
    "message": "This credential is not allowed to do that.",
    "fix": "Use a credential that has access to this resource.",
    "docs": "https://apexly.dev/docs/errors/forbidden"
  }
}
```