API 403 Forbidden Message

Since the Scraper topic was marked "answered" but only fixes it for ComicRack users, I started this topic for the rest of us that don't use that site and still encountering issues.

Since yesterday I have been getting a 403 Forbidden error whenever I try to make an API call from my site. Putting the api URL directly in the browser will return the expected information. Just won't accept my request from the website.

I have updated the API address to comicvine.gamespot.com, used several API keys, and tested both on the live site and localhost to no avail. Same 403 error every time.

Can a ComicVine Dev please weigh in on this and let us know when this will be resolved? Or if someone has a workaround, please share.

What the comicrack people found (and is probably your problem as well) is that it looks like with the move to the new servers, a User-Agent field now appears to be required. It doesn't seem to matter what the user-agent is, but just that there is one. A request with no user-agent is getting the 403. Not sure if this is intentional or a bug, but seems to be what is causing the 403.

Thanks for the reply @krandor! I'd like to hold out for at least the rest of the day to see if a Dev replies or it fixes itself before doing that, but good to know the workaround is fairly simple.

Yeah I expect this was an "unintended consequence" to the move to the new domain and stuff. Probably some new security device that is on the gamespot servers that isn't on the original comicvine system.

Hey guys. Yeah this was intentional. CBS is cracking down on bots and anonymous bots are no longer allowed. Your user agent must not be anything like "curl, perl, php, PyhonLib, wget" nor empty. Just provide a user agent preferably one that describes who you are and you'll be fine. This helps us too because we can pull reports on what you're doing and maybe find ways to make the API better for your particular use case.

Sorry the communication on this sucked...

Hey @edgework! Thanks for replying and clearing this up. We're already working on adding the user agent string to our API calls.