API integration fails with ‘The access token is missing required scopes’ (403 Forbidden)

Last update: July 1, 2026

AEM as a Cloud Service returns a 403 Forbiddenerror during Assets API requests when OAuth S2S authentication lacks required scopes, even though the integration appears correctly configured and access tokens generate successfully. Updating required scopes and regenerating the access token fixes the issue. To resolve the issue, update scopes and regenerate access token.

Description description

Environment

Adobe Experience Manager as a Cloud Service (all versions)

Issue/Symptoms

When integrating AEM as a Cloud Service with an external application via the Assets API and OAuth S2S authentication, API calls return a 403 Forbidden error. The integration configuration appears in Admin Console and access token is successfully generated from the IMS endpoint. However, API requests (for example, through the Assets API documentation) return the following error:

{
  "type": "https://api.adobeaemcloud.com/adobe/meta/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "The access token is missing required scopes."
}

The integration was set up following Adobe’s OAuth S2S documentation.
The integration appears in the Admin Console, but API calls fail with missing scope errors.

Cause

The error occurs because the access token used for API calls does not include all required OAuth scopes for the AEM Assets API, resulting in a 403 Forbidden response.

Resolution resolution

Follow these steps to resolve the issue

Verify Required OAuth Scopes
- In the Adobe Developer Console, open the relevant project and API integration.
- Ensure that all required scopes for the AEM Assets API are selected. Refer to the AEM API documentation for the list of required scopes (e.g., openid, AdobeID, read, write, etc.).
Update Integration Configuration
- If any required scopes are missing, edit the integration and add them.
- Save the changes and re-download the updated service credentials (JSON file) if applicable.
Regenerate and Use the New Access Token
- Use the updated credentials to request a new access token.
- Ensure the token request includes all required scopes in the scope parameter.
Test API Access
- Retry the API call using the new access token.
- If the error persists, verify that the integration is correctly linked in the Admin Console and that the external application’s redirect URL matches the configuration.

recommendation-more-help

experience-cloud-kcs-help-kbarticles