<![CDATA[403 calling Hosted Backend /app/refresh API]]>I'm trying to use the Hosted Backend /app/refresh API to manually refresh tokens using a valid refresh token (obtained from an external JWT reconcile call).

Using Curl as follows (sensitive values xxxx'ed out):

curl -v -X POST --cookie "app.rt=_xxxxx" http://localhost:9011/app/xxxxx

returns a 403 even though the rt and application client id are correct.

Any idea why this is happening? Running licensed starter edition, v1.69.4 locally on port 9011.

Thanks!

]]>https://fusionauth.io/community/forum/topic/3294/403-calling-hosted-backend-app-refresh-apiRSS for NodeSat, 31 Oct 2026 12:13:54 GMTWed, 28 Oct 2026 16:47:24 GMT60<![CDATA[Reply to 403 calling Hosted Backend /app/refresh API on Fri, 30 Oct 2026 20:36:03 GMT]]>@andrzej-taramina Usually, when we see 403s on the hosted backend, the root cause ends up being an origin issue.

The endpoint calls need to originate from the same domain the FusionAuth instance lives at

There's some CORS information in this section of the hosted backend docs: https://fusionauth.io/docs/apis/hosted-backend#prerequisites

]]>https://fusionauth.io/community/forum/post/8957https://fusionauth.io/community/forum/post/8957Fri, 30 Oct 2026 20:36:03 GMT