403 Forbidden on intake: the API key is wrong, revoked, or for another region

403 Forbidden on agent intake: key or region

What you see: datadog-agent status shows the forwarder failing with 403, or the agent log has lines about the intake rejecting payloads. The agent process is up. Nothing arrives in the app.

Causes, in order

1. Wrong key pasted. An application key was used where the API key goes, or the key has a typo/whitespace. The agent needs the org API key, nothing else.
2. Key revoked or rotated. Someone rotated the key in Organization Settings and this host still has the old one.
3. Right key, wrong region. The key is valid but your DD_SITE points at a region where that org does not exist. Classic after copy-pasting a US1 example into an EU setup.

Fix

• Open Organization Settings, API Keys in the app and confirm the key exists and is enabled.
• Compare the configured key with the stored one (secret manager, not chat). If they differ, update datadog.yaml or the DD_API_KEY env and restart.
• Confirm the site: the URL you log into the app with determines DD_SITE. Fix it in the same place.
• Re-run datadog-agent status: forwarder accepted payloads means you are done.

Dont do this

Do not reinstall the agent to fix a 403. The install is fine. Do not paste the key into a ticket, a log, or a chat to debug it either; rotate it if it ever lands somewhere it should not.

The API and Application Keys docs define the API key as the org credential the agent needs to submit data. The agent getting-started docs show the datadog.agent.up service check going OK only when the agent connects, and the site docs explain a key valid in one region 403s in another. Verified against live docs 2026-09-26.