API Returns "403 Forbidden Access" When Using HERE Platform Credentials with Project associations

Symptoms / Triggers

You may experience this issue if:

You receive a "403 Forbidden Access" response when calling a HERE service (Search, Routing, Geofencing, etc.).
Your API calls work correctly when using a generic App ID but fail when that App ID is associated with a specific Project.
Your credentials (API Key / OAuth) are valid, but access is denied only for certain services.
The error logs show: {"error":"Forbidden","error_description":"Access denied to the resource"}.
You recently enabled the "Allow access only in this project" flag in the Access Manager.

Quick Answer

This error occurs because your App ID is restricted to a Project that does not have the required service linked to it. To fix this, either Link the Service to your project in the Project Manager or change the App ID settings to "No Project" in the Access Manager.

Step-by-Step Resolution

Option 1: Link the Missing Service to your Project (Recommended)

Use this option if you want to keep the security benefits of Project isolation.

1. Log in to the HERE Platform portal.
2. Navigate to Project Manager and select your specific project.
3. Click on the Resources tab, then select Services.
4. Click Link a service.
5. Search for the service that is failing (e.g., "HERE Search" or "Routing") and click Link.
6. Wait 1-2 minutes for the permissions to propagate and retry your API call.

Option 2: Remove Project Restrictions from the App ID

Use this option if you want the App ID to have access to all services enabled in your plan without project-level filtering.

1. Go to Access Manager > Apps.
2. Select your App ID and click Edit.
3. Look for the "Default Access to a Project" dropdown.
4. Change the selection from your current project to "No Project".
5. Save changes. This allows the app to bypass project-specific resource filtering.

Root Cause

When an App ID is restricted to a Project, the HERE Platform applies a strict "Allow List" policy. Even if your organization has a subscription to a service, the App ID cannot use it unless that service is explicitly "linked" as a resource to that specific project. This is a security feature designed to prevent resource leakage between different teams or environments.

Expected vs Unexpected Behavior

| Feature / Behavior | Expected Behavior | Unexpected Behavior |
| --- | --- | --- |
| App with Linked Service | API call succeeds with 200 OK. | API call returns 403 Forbidden despite linking. |
| App without Project | All services in the plan are accessible. | App is still blocked (check for billing/quota issues). |
| Restricted App | Only services linked to the project work. | Any unlinked service call returns 403 Forbidden. |

Notes

Authentication vs. Authorization: A 401 Unauthorized error means your credentials are wrong. A 403 Forbidden (this case) means your credentials are correct, but you don't have permission to use that specific service.
Propagation Time: Changes in the Access Manager or Project Manager can take up to a few minutes to reflect globally.

Applies To

HERE Platform (v4)
Access Manager / Project Manager
HERE API/SDKs (Search, Routing, Geofencing, Maps)
Project-based access control (RBAC)

Tags

403 Forbidden error, access denied, HERE Platform 403, project association error, link service to project, Access Manager forbidden, HERE Search 403, Routing API forbidden, why am I getting 403 with valid credentials, project resources HERE, app ID restricted to project, allow access only in this project, Forbidden Access error description, HERE portal configuration.

Related Information

How to troubleshoot 403 Forbidden errors
* How to move or migrate resources into projects