403 Forbidden when accessing endpoints with `fastapi-clerk-middleware`

[ganeshmahadev]

---

Description

I am encountering repeated 403 Forbidden errors when using the fastapi-clerk-middleware package. The server starts successfully, but all requests to protected endpoints return a 403 Forbidden response.

---

Logs / Error Output

2025-09-04 15:25:30,430 - asyncio - DEBUG - Using selector: KqueueSelector
INFO:     Started server process [97243]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     127.0.0.1:64721 - "GET /linkedin/profile/user_32EhNkeDyCdTJcNU3ArYWRm700c HTTP/1.1" 403 Forbidden
INFO:     127.0.0.1:64721 - "GET /linkedin/profile/user_32EhNkeDyCdTJcNU3ArYWRm700c HTTP/1.1" 403 Forbidden
INFO:     127.0.0.1:64726 - "POST /linkedin/profile HTTP/1.1" 403 Forbidden
INFO:     127.0.0.1:64743 - "GET /linkedin/profile/user_32EhNkeDyCdTJcNU3ArYWRm700c HTTP/1.1" 403 Forbidden
INFO:     127.0.0.1:64743 - "GET /linkedin/profile/user_32EhNkeDyCdTJcNU3ArYWRm700c HTTP/1.1" 403 Forbidden

---

Steps to Reproduce

1. Installed fastapi-clerk-middleware using these "fastapi>=0.116.1", "fastapi-clerk-auth>=0.0.7",.
2. Configured the middleware with my Clerk API keys.
3. Started FastAPI server.
4. Tried accessing endpoints (e.g., GET /linkedin/profile/{id} and POST /linkedin/profile).
5. All requests return 403 Forbidden.

---

Expected Behavior

Authenticated requests should be authorized correctly and return the appropriate response instead of 403 Forbidden.

---

Environment

• OS: macOS (using KqueueSelector)

[horizon3-daniel]

I have seen something similar, but for us it's because the JWT has been issued in the future, and the verification fails, although in our frontend application it works fine.

[mattylight22]

Hi @ganeshmahadev, apologies for the slow reply. Can you elaborate on this?

Configured the middleware with my Clerk API keys

You shouldn't have to use Clerk API Keys, you want to configure it using the public JWKS endpoint which looks something like this

https://your-clerk-frontend-api.clerk.accounts.dev/.well-known/jwks.json

Additionally to further debug this issue you can do something like this

clerk_config = ClerkConfig(jwks_url="https://your-clerk-frontend-api.clerk.accounts.dev/.well-known/jwks.json") 

clerk_auth_guard = ClerkHTTPBearer(config=clerk_config, debug_mode=True)

Setting debug_mode to True will surface exceptions.