The request could not be satisfied on local dev

[piotrpoz]

Affected Product
Which product does this bug affect?
API

Describe the bug
Trying to oAuth2 with PCO for local development setup, which was working fine previously (last check in January 2026). Currently, when requesting https://api.planningcenteronline.com/oauth/token PCO responses with:

403 ERROR
The request could not be satisfied.
Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
Generated by cloudfront (CloudFront)
Request ID: VpmQsOr1Y5HC8wIpkON3iR5o81JM6M4Wfshxan33jEmNBzHowddnRw==

To Reproduce
Request authorization token with https://api.planningcenteronline.com/oauth/authorize?client_id=CLIENT_ID&redirect_uri=http%3A%2F%2Flocalhost%3A81%2Fintegrations%2Foauth%2Fpco&response_type=code&scope=people+calendar&state=531def25bc22f45336e3246a7d11e911

Expected behavior
Receiving a refresh token.

Additional Context:

• Endpoint: https://api.planningcenteronline.com/oauth/authorize
• Authentication: OAuth 2

Additional context

I have..

• Reviewed the documentation found at https://developer.planning.center/docs
• Searched for previous issues reporting this bug
• Removed all private information from this issue (credentials, tokens, emails, phone numbers, etc.)
• Reviewed my issue for completeness

[github-actions]

Potentially Related Issues

I found some existing issues that may be related to this one. Please check if any of them address your question before waiting for a response:

🟣 #1316 — 403 Error when doing oauth from local 127.0.0.1 dev server. (Closed)

Summary: User experienced identical 403 CloudFront error when attempting OAuth2 from localhost (127.0.0.1:3000) development server, which had been working previously until May 2025. This is nearly identical to the new issue, both involving local development OAuth flows that suddenly stopped working.

Key discussion points:

• Error affected both OAuth callback completion and the ability to edit OAuth application settings at api.planningcenteronline.com
• Planning Center staff confirmed they had been tuning their Application Firewall recently
• The blocks were not related to the user's residential IP address
• Issue affected CloudFront layer before reaching the application

Resolution: Planning Center staff (T0MM0R) made adjustments to their Application Firewall configuration. The issue was resolved within approximately 3 hours of reporting, with both local OAuth login and application management page access restored. No action was required from the user's side - it was a server-side firewall configuration issue.

---

This comment was generated automatically. If none of these match your issue, no action is needed — a team member will review your issue soon.

[glosie]

Hi @piotrpoz,

This request is getting blocked by our WAF. To help us investigate further, can you provide details from the body of the request (with any sensitive information redacted)?

Thanks!

[piotrpoz]

Hi @glosie,

I do not know what has happened but today it works perfectly fine. Regardless whether it was activity on your end, I cannot reproduce this issue anymore.

Thanks!

[geolessel]

@piotrpoz That's great! Thanks for letting us know.