403 Forbidden on intake: the API key is wrong, revoked, or for another region

TL;DR: The agent logs 403 Forbidden on intake payloads when the API key is wrong, revoked, or belongs to another region. Data stops flowing but the agent keeps running. Fix - Open Organization Settings, API Keys in the app and confirm the key exists and is enabled. - Compare the configured key with the stored one (secret manager, not chat). Fix it in the same place. - Re-run datadog-agent status: forwarder accepted payloads means you are done.

The fix

1. Wrong key pasted. An application key was used where the API key goes, or the key has a typo/whitespace. The agent needs the org API key, nothing else.
2. Key revoked or rotated. Someone rotated the key in Organization Settings and this host still has the old one.
3. Right key, wrong region. The key is valid but your DD_SITE points at a region where that org does not exist. Classic after copy-pasting a US1 example into an EU setup.
4. Open Organization Settings, API Keys in the app and confirm the key exists and is enabled.
5. Compare the configured key with the stored one (secret manager, not chat). If they differ, update datadog.yaml or the DD_API_KEY env and restart.
6. Confirm the site: the URL you log into the app with determines DD_SITE. Fix it in the same place.
7. Re-run datadog-agent status: forwarder accepted payloads means you are done.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: 403 Forbidden on intake.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current 403 behavior.

The API and Application Keys docs define the API key as the org credential the agent needs to submit data. The agent getting-started docs show the datadog.agent.up service check going OK only when the agent connects, and the site docs explain a key valid in one region 403s in another. Verified against live docs 2026-09-26.