# Diag: agent log shows 403 on intake payloads
**Symptom (exact):** forwarder errors in `datadog-agent status` or the agent log, payload submissions answered `403 Forbidden`. Agent process stays up.
**Likely causes:** (a) API key wrong or revoked, (b) application key used as API key, (c) key valid but `DD_SITE` points at the wrong region.
**Confirm:**
1. `datadog-agent status`, Forwarder section: note which endpoint 403s (metrics, logs, traces) and the exact code.
2. In the app, Organization Settings, API Keys: does the configured key exist and is it enabled? Compare with what is in `datadog.yaml` / `DD_API_KEY`.
3. Check the site line in status against the URL you log into. `datadoghq.com` in status while you log into `app.datadoghq.eu` means cause (c).
4. Direct API check: `curl` the API for your site with header `DD-API-KEY` set to the key. A 403 there with a valid-looking key confirms region mismatch over key invalidity.
**Fix:** replace the key with a current org API key, or correct `DD_SITE`, then restart the agent. One change at a time.
**Verify:** status shows payloads accepted with no 403s for two consecutive flushes, and the host appears in Infrastructure. If 403s persist after a key+site fix, the key may be scoped to a different org (multi-org setups): check which org issued it.