403 error requesting valid path with read api token

[cayblood]

I'm using an api token to request a webtools custom URL alias and getting a 403. This same api token can request collection types successfully.

For example, this is successful:

curl http://localhost:1337/api/articles/u8rjnpkqfhnl1oqk7ouiyjwb -H "Authorization: Bearer <api token>" 
{"data":{"id":19,"documentId":"u8rjnpkqfhnl1oqk7ouiyjwb","title":"What Is Mormon Transhumanism?","slug":"1-what-is-mormon-transhumanism","visiblePublishedAt":"2022-07-01","description":"Mormon Transhumanism sees science and technology as divine tools that can help us to become more like God and fulfill humanity's spiritual potential.","createdAt":"2025-07-31T05:03:51.309Z","updatedAt":"2025-08-01T14:09:20.210Z","publishedAt":"2025-08-01T14:09:20.579Z","locale":"en"},"meta":{}}

Whereas this fails with a 403:

curl http://localhost:1337/api/webtools/router?path=/beliefs/primers/1-what-is-mormon-transhumanism -H "Authorization: Bearer <api token>" 
{"data":null,"error":{"status":403,"name":"ForbiddenError","message":"Forbidden","details":{}}}

Any ideas what I'm doing wrong? Thanks in advance for your help.

[cayblood]

For what it's worth, I was able to fix this by setting my api token's permissions to custom and specifically granting it access to webtools routes. I thought that a regular read-only token would work, but apparently not.

[TMSchipper]

Hi @cayblood, thanks for opening this issue.

In Strapi v5, plugin routes don’t fall under the default scopes of read-only API tokens. Those are limited to collection and single types. Setting your token to “custom” and granting access manually is the correct way to handle this.

Do you have any questions or can I close this issue?

Kind regards,

Tim
PluginPal

[boazpoolman]

I'm wondering if this is something we can manipulate using the auth.scope config.
It's used all over the place in the Strapi monorepo:
https://github.com/strapi/strapi/blob/2a9b9b61cfdc484a1736b8c7d460c850ecc64608/packages/core/admin/shared/contracts/content-api/routes.ts#L6

@TMSchipper did you by any chance try this out already?

[boazpoolman]

Related to #7