vercel/next.js · error · Error

`forbidden()` is experimental and only allowed to be enabled

Error message

`forbidden()` is experimental and only allowed to be enabled when `experimental.authInterrupts` is enabled.

What it means

`forbidden()` is an experimental function that throws a 403 access-fallback error to render the `forbidden.js` boundary. It checks `process.env.__NEXT_EXPERIMENTAL_AUTH_INTERRUPTS` and throws this configuration error if the flag is not set, because the underlying auth-interrupts feature must be explicitly enabled via `experimental.authInterrupts` in next.config.

Source

Thrown at packages/next/src/client/components/forbidden.ts:24

// TODO: Add `forbidden` docs
/**
 * @experimental
 * This function allows you to render the [forbidden.js file](https://nextjs.org/docs/app/api-reference/file-conventions/forbidden)
 * within a route segment as well as inject a tag.
 *
 * `forbidden()` can be used in
 * [Server Components](https://nextjs.org/docs/app/building-your-application/rendering/server-components),
 * [Route Handlers](https://nextjs.org/docs/app/building-your-application/routing/route-handlers), and
 * [Server Actions](https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions-and-mutations).
 *
 * Read more: [Next.js Docs: `forbidden`](https://nextjs.org/docs/app/api-reference/functions/forbidden)
 */

const DIGEST = `${HTTP_ERROR_FALLBACK_ERROR_CODE};403`

export function forbidden(): never {
  if (!process.env.__NEXT_EXPERIMENTAL_AUTH_INTERRUPTS) {
    throw new Error(
      `\`forbidden()\` is experimental and only allowed to be enabled when \`experimental.authInterrupts\` is enabled.`
    )
  }

  const error = new Error(DIGEST) as HTTPAccessFallbackError
  ;(error as HTTPAccessFallbackError).digest = DIGEST
  throw error
}

View on GitHub (pinned to 0ae8c72462)

Solutions

1. Enable the flag in next.config: `export default { experimental: { authInterrupts: true } }`.
2. If you don't want the experimental feature, remove the forbidden() call and use a manual redirect to a 403 page.
3. Restart the dev server after changing next.config so the env var is re-injected.

Example fix

// next.config.ts
// before — missing the flag
import type { NextConfig } from 'next'
const config: NextConfig = {}
export default config

// after — enable authInterrupts
import type { NextConfig } from 'next'
const config: NextConfig = {
  experimental: { authInterrupts: true },
}
export default config

function isAuthInterruptsEnabled(): boolean {
  return process.env.__NEXT_EXPERIMENTAL_AUTH_INTERRUPTS === '1'
}
function safeForbidden(): void {
  if (!isAuthInterruptsEnabled()) {
    throw new Error('Enable experimental.authInterrupts in next.config before using forbidden()')
  }
  // call the real forbidden()
}

When it happens

Trigger: Calling `forbidden()` from `next/navigation` (or the internal forbidden module) in a Server Component, Route Handler, or Server Action without `experimental.authInterrupts: true` in next.config.js/ts.

Common situations: Following a tutorial or docs example that uses forbidden() without mentioning the required flag; upgrading Next.js and trying the new API without updating config; the flag name changed or the feature is not yet stable in your version.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• `unauthorized()` is experimental and only allowed to be used
• Could not parse output from TypeScript's --showConfig.
• The experimental.allowDevelopmentBuild option requires NODE_
• `experimental.cssChunking: "graph"` is only supported with T
• `experimental.cssChunking: "strict"` is only supported with

AI-assisted analysis of vercel/next.js@0ae8c72462 (2026-08-06). Data as JSON: /api/errors/aa38e78784bd18bd. Report an issue: GitHub.