403 Forbidden on DigitalOcean App Platform with FastAPI Backend & Streamlit Frontend

Question

I am getting a persistent 403 Forbidden error when my Streamlit frontend tries to POST to my FastAPI backend. Both are hosted on the DigitalOcean App Platform as separate components in the same App.

The Architecture:

Backend: FastAPI (Python). Route defined as @app.post("/api/ask").
Frontend:Streamlit. Calling the backend via requests.post("https://[my-app-url]/api/ask").
DO Routing Rules: Frontend: / (Preserve path), Backend: /api/* (Preserved path / No Trim Prefix)

Browser/Streamlit:Returns a raw HTML 403 Forbidden.
Logs:The FastAPI Runtime Logs are empty. The request is being blocked by the DigitalOcean/Cloudflare ingress layer(assumption) before it even reaches my application code.
Headers: The response includes server: cloudflare and x-do-orig-status: 403.

What I’ve Tried:

Verified the FastAPI backend is a Public HTTP Service, not Internal.
Hardcoded the full URL in the frontend to avoid Environment Variable issues.
Enabled CORS in FastAPI with allow_origins=["*"].
Tested both “Trim Prefix” and “Preserve Path” on the /api/* route.
Verified the backend works locally.

The Question: Even after trying all these i am still getiing 403 : Forbidden error. Please help me resolve this.

Bobby · Answer

Hi there, One important thing to clarify first is where the request is coming from. If your Streamlit app is making the requests.post(...) call server-side, then you can use App Platform’s internal networking (calling the backend via the service name). But if the request is coming from the browser/client, then it must go through the public app URL, internal service names won’t be reachable. Given your setup and the fact that FastAPI logs are empty, this looks like the request is being blocked at the ingress layer before it reaches your backend. I’d focus on these two things: Path handling between App Platform and FastAPI With a route like /api/*, App Platform will by default trim the /api prefix before forwarding the request unless “preserve path” is enabled. So: if prefix is trimmed → backend receives /ask if prefix is preserved → backend receives /api/ask That means your FastAPI route needs to match exactly what is forwarded: @app.post("/ask") (if trimmed) @app.post("/api/ask") (if preserved) A mismatch here can cause requests to fail before they hit your app logic. Make sure the request is actually reaching the backend component Since you’re seeing server: cloudflare and x-do-orig-status: 403, and no FastAPI logs, the request is likely being rejected before it reaches your app. At that point, it’s usually either: a routing rule mismatch or something being blocked at the App Platform ingress level If everything looks correct on the routing side and it still doesn’t reach FastAPI, I’d recommend opening a support ticket so the App Platform team can inspect the ingress-side 403: https://do.co/support

alexdo · Answer

Heya, The empty FastAPI logs and x-do-orig-status: 403 suggest it’s getting blocked at the Cloudflare/ingress layer before reaching your app, so CORS and route config changes won’t make a difference there. One thing I’d try — since both components are in the same App, use the internal URL instead of the public one: http://:/api/ask. That should bypass the Cloudflare layer entirely. If that works, it’s probably Cloudflare’s bot/WAF rules rejecting the server-side POST from Streamlit. Not 100% sure how to override that on App Platform though. You could also try adding a simple GET endpoint like /api/health and hitting it from the browser just to rule out routing issues. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

403 Forbidden on DigitalOcean App Platform with FastAPI Backend & Streamlit Frontend

Related questions

Is it safe to run production apps on a single DigitalOcean Droplet?

I'm getting this ERROR: you dont' have permission to complete this action

App.yaml file is not detected in the root or .do directory

ReferenceError: module is not defined in ES module scope

npm run build/vite build time out killed

Droplet's Nginx Reverse Proxy Fails with 502 Bad Gateway Only After Deploy Any Thoughts?

Cannot deploy from private github repo

Django/Nginx/Gunicorn "unknown errors" in nginx logs

How to deploy a responsive web design project on a VPS using Git?

How to skip build step for a service in app platform

Does a DO function do npm install, or I need to manually upload the node_modules folder?

How to deploy Streamlit using st.login() to Digital Ocean

Report this

403 Forbidden on DigitalOcean App Platform with FastAPI Backend & Streamlit Frontend

Related questions

Is it safe to run production apps on a single DigitalOcean Droplet?

I'm getting this ERROR: you dont' have permission to complete this action

App.yaml file is not detected in the root or .do directory

ReferenceError: module is not defined in ES module scope

npm run build/vite build time out killed

Droplet's Nginx Reverse Proxy Fails with 502 Bad Gateway Only After Deploy Any Thoughts?

Cannot deploy from private github repo

Django/Nginx/Gunicorn "unknown errors" in nginx logs

How to deploy a responsive web design project on a VPS using Git?

How to skip build step for a service in app platform

Does a DO function do npm install, or I need to manually upload the node_modules folder?

How to deploy Streamlit using st.login() to Digital Ocean