# 403 Forbidden on agent intake: key or region
What you see: `datadog-agent status` shows the forwarder failing with 403, or the agent log has lines about the intake rejecting payloads. The agent process is up. Nothing arrives in the app.
## Causes, in order
1. **Wrong key pasted.** An application key was used where the API key goes, or the key has a typo/whitespace. The agent needs the org API key, nothing else.
2. **Key revoked or rotated.** Someone rotated the key in Organization Settings and this host still has the old one.
3. **Right key, wrong region.** The key is valid but your `DD_SITE` points at a region where that org does not exist. Classic after copy-pasting a US1 example into an EU setup.
## Fix
- Open Organization Settings, API Keys in the app and confirm the key exists and is enabled.
- Compare the configured key with the stored one (secret manager, not chat). If they differ, update `datadog.yaml` or the `DD_API_KEY` env and restart.
- Confirm the site: the URL you log into the app with determines `DD_SITE`. Fix it in the same place.
- Re-run `datadog-agent status`: forwarder accepted payloads means you are done.
## Dont do this
Do not reinstall the agent to fix a 403. The install is fine. Do not paste the key into a ticket, a log, or a chat to debug it either; rotate it if it ever lands somewhere it should not.