Fix HTTP Error 403 Forbidden on YouTube Downloads
In short
HTTP Error 403 Forbidden means YouTube refused the request for the video data. B-ROLL retries once by itself with different YouTube player settings. If the card still says 'YouTube blocked this (HTTP 403)', restart B-ROLL so yt-dlp updates, retry the download, and add a current cookies.txt from your own account when the video needs sign-in.
On this page
What does HTTP Error 403 mean on a YouTube download?
HTTP Error 403 Forbidden means YouTube refused the request for the video data. The HTTP standard defines 403 as a server that understood the request but refuses to fulfill it (RFC 9110, section 15.5.4).
On a YouTube download, the refusal comes after the video was found: yt-dlp extracts a stream link, asks YouTube’s video server for the data, and gets a 403 instead of the file. RFC 9110 adds that a client may repeat the request with new or different credentials, which is why fresh links or a current cookies.txt can clear it.
The table lists each 403 variant you can meet in B-ROLL or on the yt-dlp command line, with its likely cause and fix.
| Where it appears | What it says | Likely cause | Fix |
|---|---|---|---|
| B-ROLL log, during a download | HTTP 403: retrying with a different YouTube client… |
YouTube refused the first request for the stream | Nothing yet: B-ROLL retries once with different YouTube player settings |
| B-ROLL card, after that retry | “YouTube blocked this (HTTP 403)” | Refused again, often an outdated yt-dlp or a stream that needs a PO token | Restart B-ROLL or click Force update yt-dlp, then ↻ retry |
| B-ROLL card, partway through a long or paused download | “YouTube blocked this (HTTP 403)” | The stream link or its token stopped being accepted | ↻ retry, which fetches fresh stream links |
| B-ROLL TOOLS panel, next to repeated 403s | JS runtime: missing |
yt-dlp is running without the JavaScript runtime YouTube’s challenges need | Reinstall tools, then retry |
| yt-dlp command line | ERROR: unable to download video data: HTTP Error 403: Forbidden |
Often an outdated yt-dlp or a stream that needs a PO token | yt-dlp --update-to nightly, then run the command again |
| One card only, other videos download fine | “YouTube blocked this (HTTP 403)” | Access or streams of that one video | Check the video on YouTube, then sign in with your own cookies.txt if it needs it |
What causes HTTP Error 403 on YouTube downloads?
HTTP Error 403 on YouTube downloads has four common causes: an outdated yt-dlp, a stream that needs a PO token, a stream link that expired, and a missing JavaScript runtime. Each one is fixed from your side with an update, a retry or a tools repair.
- Outdated yt-dlp. YouTube changes how it serves video, and yt-dlp adapts in updates. The yt-dlp README says its nightly channel publishes shortly before midnight UTC on any day the code changes, so a copy a few days old can already miss a fix.
- Missing PO token. A PO token is a proof-of-origin token that attests a request comes from a genuine YouTube client. As of September 2026, the yt-dlp PO Token Guide says that without one, requests for the affected clients’ format URLs may return HTTP Error 403.
- Expired or bound links. The same PO Token Guide says PO tokens have a limited lifespan, possibly as short as 12 hours, and most are bound to one video ID. A download paused for hours can therefore meet a stream link that has stopped working.
- No JavaScript runtime. As of September 2026, the yt-dlp EJS wiki says yt-dlp needs an external JavaScript runtime to solve the challenges YouTube presents, and it recommends Deno.
What does B-ROLL do when it gets a 403?
B-ROLL retries a download once, with different YouTube player settings, as soon as yt-dlp reports HTTP 403. The log shows HTTP 403: retrying with a different YouTube client… while that retry runs. If YouTube refuses the second attempt too, the card fails with “YouTube blocked this (HTTP 403)”.
B-ROLL does not loop: one automatic retry, then the decision is yours. Sign-in and bot-check errors take a different path, through your browser logins and the sign-in wizard.
B-ROLL also keeps its tools current before a 403 happens. At every launch it updates yt-dlp to the latest nightly build, and on first launch it installs Deno as its JavaScript runtime. The sidebar’s Advanced panel shows the state under TOOLS: JS runtime: ready or JS runtime: missing, ffmpeg: ready or ffmpeg: missing.
One setup quirk causes JS runtime: missing: if an ffmpeg was already on the Windows PATH at first launch, B-ROLL used it and skipped the Deno download. Reinstall tools downloads ffmpeg and Deno again. For the engine underneath, see what yt-dlp is and whether it is safe to use.
How do you fix a YouTube 403 error step by step?
Fix a YouTube 403 in the order that costs the least time: update yt-dlp, retry, check the tools, update B-ROLL, then add your own sign-in. The routine that applies to every error lives on the hub YouTube downloader not working? Fixes for editors; the table shows what each 403 step rules out and how you know it worked.
| Step | What it rules out | Sign that it worked |
|---|---|---|
| Restart B-ROLL, or click Force update yt-dlp | An outdated yt-dlp | The log shows ✓ yt-dlp update check done. |
| Check TOOLS, click Reinstall tools if needed | A missing JavaScript runtime or ffmpeg | TOOLS shows JS runtime: ready and ffmpeg: ready |
| ↻ retry on the failed card | An expired or refused stream link | The card moves on to a percentage and then done |
| About (ⓘ), Check for updates | An outdated B-ROLL | “You’re on the latest version.” or the Update available dialog |
| Settings, Cookies file, Choose… | A video that needs your own sign-in | The hint “Cookies set.” |
The cookies.txt step comes last because it involves your account: keep the file private like a password and export a fresh one when it expires, as YouTube cookies.txt: export, use and refresh it explains.
If every video still fails after all five steps, stop and try again later. The PO Token Guide warns that requests without valid tokens can get an account or IP address blocked, and repeated retries only add requests.
How is a 403 different from the bot check or a slow download?
A 403 is a refusal of one request for video data, the bot check is YouTube asking who is downloading, and a slow download is data that still arrives, only slowly. Each shows a different message in B-ROLL and needs a different fix, as the table shows, with the 429 error added.
| Problem | What B-ROLL shows | What YouTube is doing | Fix |
|---|---|---|---|
| HTTP 403 Forbidden | Log HTTP 403: retrying…, then the card “YouTube blocked this (HTTP 403)” |
Refusing the request for the stream data | Update yt-dlp, then retry |
| Bot check or sign-in | Card “Sign-in required: add a cookies.txt in Settings, then retry”, wizard “YouTube needs your login” | Asking for a signed-in session | A cookies.txt from your own account |
| Slow or throttled download | No error: the card keeps downloading with a low live speed | Serving the data slowly | Check the causes of slow downloads |
| HTTP 429 Too Many Requests | The yt-dlp error line on the card | Blocking your IP address because of overuse, per the yt-dlp FAQ | Stop downloading and try later |
Each has its own page: fix “Sign in to confirm you’re not a bot” on YouTube and YouTube download slow or throttled? Causes and fixes. A download that sits still with no error is a fourth case: YouTube download stuck at 0% or 99%.
What if only one video returns a 403?
A 403 on one video while others download normally points at that video’s access or streams, not at your copy of yt-dlp. Check the video itself first, then retry.
- Open it on YouTube. Right-click the card and choose Open on YouTube. If the video plays only when you are signed in, set a cookies.txt from your own account and retry.
- Retry later. A refused link on one video can be temporary, so click ↻ retry once after a pause.
- Send the log. Click Report a bug in the Advanced panel. It opens your email app with your description and, with Include the download log ticked, the last 4,000 characters of the log, so Ema Zamboni, who builds B-ROLL, can see which request YouTube refused. Nothing is sent until you send the email.
How to fix HTTP Error 403 in B-ROLL
-
Let the automatic retry finish
When the log shows HTTP 403: retrying with a different YouTube client…, wait. B-ROLL retries once with different YouTube player settings before it reports an error on the card.
-
Update yt-dlp
Close and reopen B-ROLL, which updates yt-dlp to the latest nightly build at every launch, or click Force update yt-dlp in the sidebar's Advanced panel.
-
Check the tools
In the Advanced panel, read the TOOLS status. If it shows JS runtime: missing or ffmpeg: missing, click Reinstall tools.
-
Retry the download
Click retry (↻) on the failed card. The download goes back into the queue and asks YouTube for fresh stream links.
-
Update B-ROLL itself
Open About (ⓘ) and click Check for updates. If the Update available dialog appears, click Update now.
-
Add your own sign-in if the video needs it
In Settings, under Cookies file, click Choose… and pick a cookies.txt exported from your own signed-in YouTube account, then retry the card.
Frequently asked questions
Does a 403 mean I am blocked?
No. A 403 means YouTube refused one request for video data, and an updated yt-dlp or a fresh retry usually clears it. A block is a different situation: the yt-dlp PO Token Guide warns that requests without the tokens YouTube expects can get an account or IP address blocked. If every video keeps failing after the fixes, stop retrying and try again later.
Why does it fail halfway through?
A download that fails partway usually met a stream link that YouTube stopped accepting. The yt-dlp PO Token Guide says the tokens behind those links have a limited lifespan, possibly as short as 12 hours, and most are bound to one video. Clicking retry on the card starts a new attempt that asks YouTube for fresh links.
Does restarting the download help?
Yes. A retry starts a new yt-dlp run, which asks YouTube for the stream links again, so a refused or expired link gets replaced. B-ROLL already retried once on its own before the card showed the 403, so restart B-ROLL first: that updates yt-dlp at launch, and the retry then runs on the newest build.
Sources
- RFC 9110, HTTP Semantics: 403 Forbidden rfc-editor.org
- yt-dlp wiki: PO Token Guide github.com
- yt-dlp wiki: EJS (JavaScript runtime for YouTube) github.com
- yt-dlp README on GitHub github.com
- yt-dlp wiki: FAQ github.com
