Widget Token Restricted

What it means

A widget-scoped (ibw_*) token was used to call an endpoint other than submitting feedback or a reaction, the only two things a widget token can do.

This usually points at your integration's setup rather than anything the end user did. Show the end user a generic message like "Something went wrong on our end.", and log detail for your own debugging.

How to fix it

1. 1.

   Trying to read, list, update, or delete data with a widget token.

   Widget tokens are intentionally write-only for public embeds. Use a full-access (ib_*) token from a trusted backend for anything else.

Where this happens

Enforced by shared authentication middleware before any endpoint-specific code runs. Every /api/v0/ endpoint except POST /feedback and POST /reactions rejects a widget-scoped token with this error.