Why Does My Substack Script Get a 403 Error?

The problem

"call it from node or curl and it 403s no matter what cookies you send." — r/automation, August 2026

"At first glance, there seems to be an issue with the Create Note function, which ends in a 403 error." — n8n community, November 2025

You wrote a script, a Zap or an n8n flow to post a Note, create a draft or add a subscriber. It worked once, or never, and now every call comes back 403 Forbidden or asks for a captcha. You are not alone. In our review of public Reddit, X, Hacker News and GitHub posts (October 2026), 16 developer sources described the write path being blocked: 403 on Notes, captchas at login, sessions that expire and fail silently. Typical examples are the n8n Substack node thread, where several users hit 403 on "Create Note", python-substack issue #27 on login captchas, and the r/automation thread above.

This page explains why it happens, why the popular workarounds put your account at risk, and what to use instead. It contains no instructions for getting past Substack's checks, on purpose.

Why does Substack return 403 to my script?

Because there is no public write API, and the endpoints your script is calling were built for Substack's own web app.

• No official write route. As of October 2026 the Publisher API is read-only (posts, post stats, subscriber counts and a single-email lookup, per the dkships wrapper). The official MCP server "cannot publish posts, send Notes, or modify your account" (Substack help). Everything that writes (drafts, publishing, Notes, sign-ups, adding subscribers) goes through internal endpoints meant for a person in a browser.
• Those endpoints check more than your cookie. The developer in the r/automation thread copied "the entire cookie jar, every header, correct origin and referer" and still got 403. Their conclusion was that Substack checks the client, not just the session. That is one developer's report, but it matches the pattern in the n8n thread.
• Logins from scripts meet a captcha. python-substack users see APIError(code=401): Please complete the captcha to continue (issue #27). Logging in repeatedly makes it worse.
• Sessions expire, sometimes silently. One builder warned that "the failure mode is silent (returns 200 with a redirect instead of an error)" (Indie Hackers). A 200 doesn't always mean the post was saved.

What about reads, RSS and custom domains?

Reads are a different story. In our own check on 21 October 2026, 15 of 15 polite public reads returned 200, including a publication on a custom domain and a request with a plain curl user agent. So if you get 403 on a simple read, the likely causes are:

What you see	Likely cause	What to do instead
403 on POST (Note, draft, subscribe, add subscriber)	Write endpoint refuses non-browser clients	Buffer or Typefully for Notes; the editor for posts; Substack's own signup embed for readers
401 "complete the captcha"	Scripted login	Stop logging in from code; use an official surface
429 "Too Many Requests"	Rate limit on bulk reading (Substack2Markdown #28)	Your own export for your archive; RSS for new posts
403 from a cloud server on reads	Your host's IP range blocked (reported for Azure)	RSS or a cached copy of your own posts
200 but nothing happened	Expired session, redirect to login	Don't build on session-based writes

A 200 status is not permission. The Terms of Use ban anyone who "Crawls," "scrapes," or "spiders" any page or data on Substack "through use of manual or automated means" (Substack Terms).

Why are cookie and browser-control workarounds risky?

The workarounds people share all do one thing: make a script look like you in a browser. Some copy a logged-in session into a server or cloud tool. Others remote-control a real logged-in browser. Either way, Substack's terms are what decide the risk, not whether the request goes through. Quoting the Terms of Use, you may not:

• run "any processes that run or are activated while you are not logged into Substack";
• do anything that "Jeopardizes the security of your Substack account or anyone else's (such as allowing someone else to log into Substack as you...)".

The Publisher Agreement adds a ban on conduct that "accesses in an unauthorized manner the devices, servers, networks, or other properties or services of Substack".

Integrators read these the same way. The scheduler Zernio rejected a Substack Notes request with: "We are not going to build this, because Substack still has no write API" (Zernio board). A commenter in a marketing-automation thread called browser automation for this "a ticking time bomb" (r/MarketingAutomation). The downside isn't a broken script. It is a flagged or suspended account, and with it your list and archive.

What can I use instead?

You want to	Legal route (October 2026)	Notes
Read your own posts in code	RSS at /feed (help) for recent posts; your export zip (help) for the full archive	The export includes posts, subscriber list and stats
Read posts and stats by API	Publisher API, if enabled for your publication	Read-only; key per publication
Let an AI assistant read your stats	Official Substack MCP (help)	Admins of Bestseller publications only; read-only
Schedule Notes	Buffer or Typefully	Buffer: top-level Notes only, all plans including Free
Publish long-form posts	Substack's editor and scheduler	No official API
Add subscribers	Reader signs up on Substack's form or embed; reviewed CSV import of opted-in contacts	See how to add subscribers

For the full list of official surfaces, see does Substack have an API. If you want an AI agent to draft from your archive, the MCP options page compares what each server can and can't do.

What not to do

• Don't copy your session into a server, a cloud automation or a third-party "Substack API" that asks for it.
• Don't spoof browser headers, rotate proxies or use captcha services to get past a 403 or 401.
• Don't retry writes in a loop. Without a real API, a lost response can mean a duplicate draft or a double-scheduled Note.
• Don't treat a 200 from a read endpoint as permission to bulk-collect other publications' data.

Where newsletterapi fits

Our Posts & Archive API gives you your own archive as clean JSON, Markdown or HTML, built from your RSS feed and your uploaded export, read-only and with no Substack login. If it would replace your scraper, get access on that page or email hello@newsletterapi.io.