# 403 forbidden ansible galaxy API keys

**URL:** <https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363>\
**Category:** Get Help\
**Tags:** galaxy-ng\
**Created:** [October 3, 2023, 3:23pm UTC](https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363 "2023-10-03T15:23:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![johrstrom](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/johrstrom/32/959_2.png) [@johrstrom](https://forum.ansible.com/u/johrstrom)\
**Post date:** [October 3, 2023, 3:23pm UTC](https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363/1 "2023-10-03T15:23:08Z")

</div>

Hi - I went to publish a role this morning `osc.open_ondemand` (or `OSC.open_ondemand` I can’t tell which is legit and which is a copy) and started to get 403 forbidden errors.

I regenerated the key for the robotic user that does this work to no avail. I can’t tell if that robotic user is even has access to the role anymore.

So I then tried to generate an API key for myself, but it still doesn’t work. The key I generated was in the UI’s `collections` tab and I’m trying to upload a `role`, so that could be the issue - but if that’s the case the UI doesn’t show me how to generate an API key for a `role`.

---

<div class="post-metadata">

**Author:** ![johrstrom](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/johrstrom/32/959_2.png) [@johrstrom](https://forum.ansible.com/u/johrstrom)\
**Post date:** [October 3, 2023, 7:30pm UTC](https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363/2 "2023-10-03T19:30:14Z")

</div>

I feel like this is a duplicate of this topic:

> [@How to Import ansible role on galaxy.ansible.com](http://forum.ansible.com/t/how-to-import-ansible-role-on-galaxy-ansible-com/1248):
>
> Hi everyone. Since ansible galaxy somehow morphed into galaxy-ng, I can’t figure out how to update my ansible content there or upload new roles. It feels like ansible roles are no longer wanted or supported. Most of the time I have been using robertdebock’s gh action from [https://github.com/marketplace/actions/publish-ansible-role-to-galaxy](https://github.com/marketplace/actions/publish-ansible-role-to-galaxy). This uses the ansible-galaxy tool. ansible-galaxy role import \ --api-key ${galaxy\_api\_key} \ --branch ${git\_branch} \ $(echo $GITHUB\_REPOSITOR…

---

<div class="post-metadata">

**Author:** ![geoffreyvanwyk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/geoffreyvanwyk/32/995_2.png) [@geoffreyvanwyk](https://forum.ansible.com/u/geoffreyvanwyk)\
**Post date:** [October 4, 2023, 4:32pm UTC](https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363/3 "2023-10-04T16:32:05Z")

</div>

At least this topic highlights the fact that the API key might just be for collections and not for standalone roles.

---

<div class="post-metadata">

**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\
**Post date:** [January 8, 2024, 4:12pm UTC](https://forum.ansible.com/t/403-forbidden-ansible-galaxy-api-keys/1363/4 "2024-01-08T16:12:39Z")

</div>

API keys are not scoped, and will work for collection uploads and role imports as long as the user for the key has RBAC control of the destination namespace.