Skip to content
ShiftGraph

HTTP 403, authentication and identity

AUTH-012

Cross-site request blocked.

What it means

A state-changing request arrived without a matching origin or the double-submit token. Both layers exist because a browser session is ambient authority.

What to do

Retry from the application. If you are calling the API directly, use a Bearer token, which is exempt by construction because it carries no ambient cookie.

The response

Every failure arrives in this shape. The trace_id is worth keeping: it identifies the request in our logs and carries nothing about your data.

{
  "type": "https://shiftgraph.dev/errors/AUTH-012",
  "title": "Cross-site request blocked.",
  "status": 403,
  "code": "AUTH-012",
  "trace_id": "01J8Z…"
}

Related codes

Sessions, second factors, sign-in methods, and the credentials that reach the API. A second factor is required of every account, so several of these have no bypass by design.

The full error reference, or write to support@shiftgraph.dev with the trace id.