Sentry: 403 from the ingest endpoint

TL;DR

Project deleted or DSN rotated. If events stopped at a specific time, check the audit log for key changes.

Steps

1. DSN belongs to a different org than you think. Org slugs get reused across personal and work accounts. The 403 means the key in the DSN is not valid for the host it is posted to.
2. Project deleted or DSN rotated. Client keys can be rotated in project settings; the old DSN 403s immediately. If events stopped at a specific time, check the audit log for key changes.
3. Self-hosted URL mismatch. The SDK posts to the host in the DSN. If the DSN says sentry.io but the project lives on your self-hosted instance (or vice versa), the receiving side has no such project and refuses. Same for region hosts: a DSN on [org].ingest.sentry.io posted to the EU host (or the reverse) fails.
4. Adblocker or egress proxy interfering. Some proxies return 403 for blocked hosts. If it 403s only from browsers on certain networks, test with the tunnel route or from curl on the server.
5. Correct the DSN or the target host, trigger one error, and confirm arrival. For self-hosted, also confirm SENTRY_URL (CLI) and the DSN host agree, since the CLI and the SDK are configured independently.

When to use

You are seeing this: SDK debug logs show the envelope POST returning 403. Use this skill when you run into "Sentry: 403 from the ingest endpoint".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Researched against live Sentry docs 2026-09-26. The quotas page (docs.sentry.io/pricing/quotas/) documents that Sentry confirms each event includes a valid DSN and project before parsing, rejecting otherwise. The CLI configuration page (docs.sentry.io/cli/configuration/) documents SENTRY_URL defaulting to https://sentry.io/ and the need to point it at a self-hosted install. The auth tokens page (docs.sentry.io/account/auth-tokens/) documents organization tokens being bound to one organization.