HTTP 403 Forbidden on HeiGIT Directions API Despite Active API Key and Available Quota

openrouteservice
1

Hello HeiGIT Team,

I am integrating OpenRouteService Directions API into my React Native Expo application (KaamWala).

I recently migrated from the old API endpoint to the new HeiGIT endpoint as instructed:

https://api.heigit.org/openrouteservice/v2/directions/driving-car/geojson

However, every valid POST request returns HTTP 403 Forbidden.

Here are the details:

  • API endpoint: api.heigit.org/openrouteservice/v2/directions/driving-car/geojson

  • Method: POST

  • Authentication: Authorization header with my API key

  • Content-Type: application/json

  • Request format: Valid GeoJSON Directions request with longitude, latitude coordinate pairs.

  • API key: Active

  • Dashboard quota: 2,000/2,000 Directions requests available.

I have also replaced the API key and restarted my local Supabase Edge Function, but the request still returns HTTP 403.

Could you please check:

  1. Is my API key authorized to access the new api.heigit.org endpoint?

  2. Is Directions API access enabled for my account?

  3. Is there any account restriction or additional configuration required?

I can provide further diagnostic information if needed.

Thank you for your support.

2

Hey,

the short answer is 1 - Yes, 2 - Yes, 3 - No.

Most issues regarding 403 - Access disallowed stem from improper copy-pasting of the API key.

Please make sure that you only copy your API key from your Account Dashboard at account.heigit.org. To do so, please use the Copy Button next to your API key. Do NOT copy the shown string with the asterisks.

When used, your key should:

  1. Start with the characters shown in the dashboard (usually “ey”)
  2. End with the characters shown in the dashboard (usually “0=”)
  3. include the substring shown in the dashboard.

Best regards

3

one more thing worth checking, since its going through a supabase edge function, is how the key is sent in the authorization header. ors expects just the key on its own, not bearer plus the key, and a lot of http clients add bearer by default, which would give a 403 even with a good key.

1 Like