403 error code 1010 'Access denied' on the Resend API

TL;DR

Set it at the client level so it applies to every request, not per call. Fix: add a User-Agent header to your client configuration, e.g. my-app/1.0.

Steps

1. Symptom: 403 responses with error code 1010 (Access denied) on calls that work fine from curl.
2. Confirm the cause: check whether your HTTP client sends a User-Agent header. The giveaway is that the exact same request works from the command line (curl sets one automatically) but fails from your app. SDKs set it automatically, so this only hits raw HTTP calls.
3. Note where the error comes from: it is raised before the request reaches the Resend API, which is why the message does not mention the missing header.
4. Fix: add a User-Agent header to your client configuration, e.g. my-app/1.0. Set it at the client level so it applies to every request, not per call.
5. Verify: re-run the failing call and confirm a 200/202 instead of the 403.
6. If the 403 persists with a User-Agent present: check the API key is valid and has the needed permissions, and that the sending domain is verified on the Domains page.

When to use

You are seeing this: Symptom: 403 responses with error code 1010 (Access denied) on calls that work fine from curl. Use this skill when you run into "403 error code 1010 'Access denied' on the Resend API".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Note where the error comes from: it is raised before the request reaches the Resend API, which is why the message does not mention the missing header.

Documented in Resend knowledge base: error 1010 403s happen when the User-Agent header is missing, are blocked before reaching the API, work from curl (which sets one), and are fixed by adding the header. SDKs include it automatically. Evidence: resend.com/docs/knowledge-base/403-error-1010.