# The app returned "Forbidden" **URL:** \ **Category:** Zapier\ **Created:** [December 1, 2021, 7:48pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89 "2021-12-01T19:48:28Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 1, 2021, 7:48pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/1 "2021-12-01T19:48:28Z")
Trying to get Zapier to create a link but I get a Forbidden error and says Zapier doesn’t have the permission. As far as I can see I’ve given all the permissions I can to the a third party like Zapier. Is there something I’m missing? Thank you ---
**Author:** ![jhodges](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.frame.io/jhodges/32/3_2.png) [@jhodges](https://forum.frame.io/u/jhodges)\ **Post date:** [December 1, 2021, 8:11pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/2 "2021-12-01T20:11:34Z")
I may know what’s going on here. Are you authenticating via a developer token or OAuth? Also, I’m assuming you’re trying to make a Review Link - and not a presentation link via a code block? ---
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 1, 2021, 8:36pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/3 "2021-12-01T20:36:46Z")
I’m pretty sure it’s the developer token for Zapier. Yes, trying to make a Review Link ---
**Author:** ![jhodges](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.frame.io/jhodges/32/3_2.png) [@jhodges](https://forum.frame.io/u/jhodges)\ **Post date:** [December 1, 2021, 8:44pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/4 "2021-12-01T20:44:22Z")
Got it, so in that case it’s possible your token doesn’t have permission to create a review link. It’s also possible that within your Zap you’re attempting to make a review link using an ID that doesn’t actually correspond to the right ID for an asset, I know our payloads are pretty verbose and can be confusing. Do you mind sharing some screenshots of your Zap, while making sure to obscure any private info? ---
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 1, 2021, 8:48pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/5 "2021-12-01T20:48:39Z")
you bet! ![Screen Shot 2021-12-01 at 1.45.32 PM](https://canada1.discourse-cdn.com/flex035/uploads/frame1/original/1X/8da1b8b1706226047b43276fda979f9f19ea5a0a.png) ![Screen Shot 2021-12-01 at 1.46.18 PM](https://canada1.discourse-cdn.com/flex035/uploads/frame1/original/1X/aebf1f7e7f78e71f38b2b34fb61f9d39424af744.png) ![Screen Shot 2021-12-01 at 1.46.34 PM](https://canada1.discourse-cdn.com/flex035/uploads/frame1/original/1X/c39880695655c68574a3d5326fdf2e0ce1cb5074.png) ![Screen Shot 2021-12-01 at 1.47.24 PM](https://canada1.discourse-cdn.com/flex035/uploads/frame1/original/1X/520daa916e4fd2814edbbb7bafa313110610bdaf.png) ![Screen Shot 2021-12-01 at 1.47.36 PM](https://canada1.discourse-cdn.com/flex035/uploads/frame1/original/1X/fb3941189b4326aafc69cdb5412bc8a3b573e655.png) ---
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 1, 2021, 9:39pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/6 "2021-12-01T21:39:12Z")
let me know if you need anything else ---
**Author:** ![jhodges](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.frame.io/jhodges/32/3_2.png) [@jhodges](https://forum.frame.io/u/jhodges)\ **Post date:** [December 1, 2021, 10:17pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/7 "2021-12-01T22:17:51Z")
That all looks good to me. I did see that you have an additional token on your account labelled “review links” that only has permissions to create, read, update, and delete review links. I’ve never tried being this explicit with the token scopes but it’s quite possible that you also need to add `account_read`, `team_read`, `project_read`, `project_update` and `asset_read` just to be safe because of other API calls that happen during the course of the creation of a review link which are currently being blocked. ---
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 2, 2021, 4:29pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/8 "2021-12-02T16:29:49Z")
What do you have to do after you create the token? I copied it but does that info need to go somewhere? ---
**Author:** ![MonumentPost](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MonumentPost](https://forum.frame.io/u/MonumentPost)\ **Post date:** [December 3, 2021, 5:53pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/9 "2021-12-03T17:53:56Z")
Update: I changed Invite Only to false and it worked. ---
**Author:** ![jhodges](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.frame.io/jhodges/32/3_2.png) [@jhodges](https://forum.frame.io/u/jhodges)\ **Post date:** [December 7, 2021, 11:53pm UTC](https://forum.frame.io/t/the-app-returned-forbidden/89/10 "2021-12-07T23:53:17Z")
Okay, that’s quite odd. Do you know if maybe your account doesn’t allow public shares at the org level?