Invalid CSRF token
A mutating request failed requireCsrf — missing/wrong x-csrf-token header or cookie mismatch. Common 403 across login actions, account APIs, admin saves, upload, and checkout.
Why this happens
Token from GET /api/auth/csrf was not sent, was stale after a long idle tab, or cookies were blocked so the server could not validate the pair. Distinct from failing to load the token (Could not load / get CSRF / security token articles).
Diagnose and fix
1. Hard refresh the page; retry so a fresh CSRF token is fetched and attached.
2. Allow cookies; stay on the same HTTPS origin.
3. Sign in again if the session expired mid-form.
4. Browser Network: failed request should include x-csrf-token; compare with a new /api/auth/csrf response.