# Renovate-bot 403 errors

**URL:** <https://forum.codefloe.com/t/renovate-bot-403-errors/118>\
**Category:** Site Feedback\
**Created:** [June 18, 2026, 1:07pm UTC](https://forum.codefloe.com/t/renovate-bot-403-errors/118 "2026-06-18T13:07:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pbaylas](https://forum.codefloe.com/letter_avatar_proxy/v4/letter/p/858c86/32.png) [@pbaylas](https://forum.codefloe.com/u/pbaylas)\
**Post date:** [June 18, 2026, 1:07pm UTC](https://forum.codefloe.com/t/renovate-bot-403-errors/118/1 "2026-06-18T13:07:46Z")

</div>

(First off, thanks to the maintainers! I started using Codefloe last week and I’ve been really impressed!)

I’ve been trying to get the renovate-bot working with one of my private repos. According to the [dashboard](https://renovate.codefloe.com/), it’s hitting a 403 error trying to access the repo:

```auto
{
  "name": "renovate",
  "hostname": "codefloe-org-repo-053f3d47kgmgs-wwmxl",
  "pid": 94,
  "level": 20,
  "logContext": "2a696ef3-ed25-4fcf-94b6-02153320c387",
  "repository": "org/repo",
  "msg": "GET https://codefloe.com/api/v1/repos/org/repo/pulls?state=all&sort=recentupdate&limit=100&poster=renovate-bot = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=8)",
  "time": "2026-06-18T12:30:51.457Z",
  "v": 0
}

```

I thought at first that I’d done something wrong giving renovate-bot access to the repo, but then I noticed that the public repos that I can see in the dashboard are hitting the same error, so I suspect it’s infrastructural.

---

<div class="post-metadata">

**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/42_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\
**Post date:** [June 18, 2026, 3:49pm UTC](https://forum.codefloe.com/t/renovate-bot-403-errors/118/2 "2026-06-18T15:49:00Z")

</div>

Spot on! After we hardened our proxy a few days ago against the Git scraping with many labels, the renovate requests are now affected by this. We actually already had a allowlist in place for `RenovateBot|renovate-operator` but the requests are now carrying `Renovate` only.

We’ve now allowlisted our internal IPs, which run the bot in the first place, and removed the UA allowlist. The next jobs should be processing the repos again.

Thanks for reporting! ❤