# HTTP 403 Forbidden on HeiGIT Directions API Despite Active API Key and Available Quota

**URL:** <https://ask.openrouteservice.org/t/http-403-forbidden-on-heigit-directions-api-despite-active-api-key-and-available-quota/8141>\
**Category:** openrouteservice\
**Created:** [November 4, 2026, 8:10am UTC](https://ask.openrouteservice.org/t/http-403-forbidden-on-heigit-directions-api-despite-active-api-key-and-available-quota/8141 "2026-11-04T08:10:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Layyah\_Production\_Sp](https://ask.openrouteservice.org/user_avatar/ask.openrouteservice.org/layyah_production_sp/32/4743_2.png) [@Layyah\_Production\_Sp](https://ask.openrouteservice.org/u/Layyah_Production_Sp)\
**Post date:** [November 4, 2026, 8:10am UTC](https://ask.openrouteservice.org/t/http-403-forbidden-on-heigit-directions-api-despite-active-api-key-and-available-quota/8141/1 "2026-11-04T08:10:44Z")

</div>

Hello HeiGIT Team,

I am integrating OpenRouteService Directions API into my React Native Expo application (KaamWala).

I recently migrated from the old API endpoint to the new HeiGIT endpoint as instructed:

[https://api.heigit.org/openrouteservice/v2/directions/driving-car/geojson](https://api.heigit.org/openrouteservice/v2/directions/driving-car/geojson)

However, every valid POST request returns HTTP 403 Forbidden.

Here are the details:

- API endpoint: [api.heigit.org/openrouteservice/v2/directions/driving-car/geojson](http://api.heigit.org/openrouteservice/v2/directions/driving-car/geojson)

- Method: POST

- Authentication: Authorization header with my API key

- Content-Type: application/json

- Request format: Valid GeoJSON Directions request with longitude, latitude coordinate pairs.

- API key: Active

- Dashboard quota: 2,000/2,000 Directions requests available.

I have also replaced the API key and restarted my local Supabase Edge Function, but the request still returns HTTP 403.

Could you please check:

1. Is my API key authorized to access the new [api.heigit.org](http://api.heigit.org) endpoint?

2. Is Directions API access enabled for my account?

3. Is there any account restriction or additional configuration required?

I can provide further diagnostic information if needed.

Thank you for your support.

---

<div class="post-metadata">

**Author:** ![jschnell](https://ask.openrouteservice.org/user_avatar/ask.openrouteservice.org/jschnell/32/971_2.png) [@jschnell](https://ask.openrouteservice.org/u/jschnell)\
**Post date:** [November 4, 2026, 8:12am UTC](https://ask.openrouteservice.org/t/http-403-forbidden-on-heigit-directions-api-despite-active-api-key-and-available-quota/8141/2 "2026-11-04T08:12:27Z")

</div>

Hey,

the short answer is 1 - Yes, 2 - Yes, 3 - No.

Most issues regarding `403 - Access disallowed` stem from improper copy-pasting of the API key.

Please make sure that you only copy your API key from your Account Dashboard at [account.heigit.org](http://account.heigit.org). To do so, please use the Copy Button next to your API key. Do NOT copy the shown string with the asterisks.

When used, your key should:

1. Start with the characters shown in the dashboard (usually “ey”)
2. End with the characters shown in the dashboard (usually “0=”)
3. include the substring shown in the dashboard.

Best regards

---

<div class="post-metadata">

**Author:** ![rachelwilson](https://ask.openrouteservice.org/letter_avatar_proxy/v4/letter/r/8edcca/32.png) [@rachelwilson](https://ask.openrouteservice.org/u/rachelwilson)\
**Post date:** [November 9, 2026, 7:46am UTC](https://ask.openrouteservice.org/t/http-403-forbidden-on-heigit-directions-api-despite-active-api-key-and-available-quota/8141/3 "2026-11-09T07:46:01Z")

</div>

one more thing worth checking, since its going through a supabase edge function, is how the key is sent in the authorization header. ors expects just the key on its own, not bearer plus the key, and a lot of http clients add bearer by default, which would give a 403 even with a good key.