40302 — forbidden

A capability or role check failed — for example publishing on a spectator socket, or an admin route the token's roles do not cover. Terminal for that action.

At a glance — HTTP 403 · close 1008 Forbidden · terminal · depends on the role/capability, not the connection.

What to do

• Check the JWT roles claim against what the action requires — the Auth / JWT cookbook maps roles to routes.
• On the WebSocket, the SDK maps a Forbidden close to FluxyNotMemberError; the raw close reason keeps the server's wording.
• This can be action-scoped rather than connection-scoped: a spectator stays connected but cannot publish.

Related

• 40300 not_member
• 40301 banned
• 10008 ws_policy