IndexerNow
Tools…

API errors

Fix: Google Indexing API 403 Forbidden

updated 2026-05-28
The symptom

HTTP 403 — "Permission denied. Failed to verify the URL ownership."

TL;DR — the fix

Nine times out of ten a 403 means the service account that signs your API requests is not added as an Owner of the exact Search Console property that contains the URL. Add it as Owner (not Full or Restricted), confirm the property type matches, and the 403 clears.

You wired up the Google Indexing API, sent your first publish request, and got slapped with a 403. The response body usually reads "Permission denied. Failed to verify the URL ownership." The good news: this is one of the most predictable errors in the whole API. It's almost never about the URL itself — it's about who is allowed to speak for that URL.

What a 403 actually means

The Indexing API authenticates as a service account, not as you. Before Google will accept a crawl hint for a URL, it checks that the service account is a verified Owner of a Search Console property that covers that URL. If that link is missing or wrong, you get a 403 — full stop. The five usual causes, in rough order of frequency:

  1. The service account is not added to Search Console at all.
  2. It's added, but with the wrong permission level — Full or Restricted instead of Owner. The Indexing API requires Owner.
  3. It's an Owner of a different property than the one the URL belongs to.
  4. Property-type mismatch: the service account owns the URL-prefix property but the URL only resolves under the Domain property (or vice-versa).
  5. The Indexing API isn't enabled in the Google Cloud project the service account lives in.

The fix, step by step

  1. Find the service account's email — it looks like [email protected]. It's in the JSON key file under "client_email".
  2. Open Search Console → Settings → Users and permissions for the property that contains your URL.
  3. Add the service account email as a user and set the permission to Owner. Not Full. Not Restricted. Owner.
  4. Confirm the property actually covers your URL. If your URL is https://www.example.com/page and you added the account to a URL-prefix property for http://example.com, that won't match — add it to the property whose prefix (or domain) the URL truly falls under.
  5. In Google Cloud Console → APIs & Services, confirm the Indexing API is enabled for the project the service account belongs to.
  6. Wait a couple of minutes for the ownership change to propagate, then retry the request.
Domain vs URL-prefix is the sneaky one

If you verified your site as a Domain property (DNS), add the service account to that Domain property — it covers every subdomain and protocol. If you only have a URL-prefix property, the service account must own the exact prefix the URL sits under, scheme and www included.

Still 403 after adding it as Owner?

  • Double-check you edited the right property — it's easy to have three near-identical properties listed and add the account to the wrong one.
  • Make sure you're signing requests with the service account whose email you added, not a second key file from another project.
  • Give it 5–10 minutes. Ownership grants are usually instant but occasionally lag.
  • Confirm the JSON key hasn't been disabled or deleted in IAM.

IndexerNow runs on your own Google account, your own Cloud project, and your own quota — we never pool submissions through a shared account. Connect your GSC and push the URL through Google's Indexing API in two clicks.

Connect your own GSC and index now

Frequently asked

Does the Indexing API need Owner, or is Full permission enough?

Owner. The Indexing API explicitly requires the service account to be a verified Owner of the property. Full and Restricted users can see data in Search Console but cannot authorize Indexing API requests, and will return a 403.

Can one service account own multiple properties?

Yes. Add the same service account email as an Owner on every Search Console property whose URLs you intend to submit. A single Domain property is the cleanest option because it covers all subdomains and protocols at once.

Why do I get a 403 only for some URLs?

Those URLs fall under a property the service account doesn't own. Verify the specific property each failing URL belongs to and add the account as Owner there.

Related fixes

Fix: Indexing API "Permission denied. Failed to verify the URL ownership."

The Indexing API "Permission denied. Failed to verify the URL ownership" error means your service account isn't a verified Owner of the matching Search Console property. Here's the fix.

How to add a service account as Owner in Search Console

Step-by-step: create a service account, find its email, and add it as an Owner of your Search Console property so the Google Indexing API will accept your requests.

Fix: Indexing API quota exceeded (429 RESOURCE_EXHAUSTED)

Hit the Indexing API's 200-requests-per-day publish cap or its per-minute rate limit? Here's how to confirm which quota you blew, request an increase, and keep indexing in the meantime.