Symptom: the key authenticates (no 401) but POST /v3/mail/send returns 403 access forbidden.
1. Read the errors array. If the message is about access rather than the sender identity, it is a scope problem.
2. Check the key's permissions: Settings > API Keys > the key > Edit. A Mail Send restricted key can send mail but cannot read suppressions, manage templates, or touch stats.
3. Fix: create a new key with Restricted Access granting Mail Send (Full Access under Mail Send is the usual pick), deploy it, then delete the under-scoped key.
4. Do not fix a 403 by switching to Full Access in production. Full Access grants every endpoint; it is a development convenience, not a production posture.
5. Remember a key can never have greater permissions than the user who created it. If the creator is a restricted teammate, the key inherits that ceiling.
If the 403 message is instead about the from address not matching a verified Sender Identity, that is a different 403: see the sender-identity skill.