# Aggregate verifier returns 403 on feature-access — needs provisioning

**URL:** <https://builder.metamask.io/t/aggregate-verifier-returns-403-on-feature-access-needs-provisioning/3181>\
**Category:** Embedded Wallets (Web3Auth)\
**Tags:** embedded-wallet, web3auth\
**Created:** [June 4, 2026, 9:24am UTC](https://builder.metamask.io/t/aggregate-verifier-returns-403-on-feature-access-needs-provisioning/3181 "2026-06-04T09:24:52Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/metamaskbuilderhub/original/1X/082cfc3a14103b01cfa5ef7d85f1121a23fa3e81.png) [@system](https://builder.metamask.io/u/system)\
**Post date:** [June 4, 2026, 9:26am UTC](https://builder.metamask.io/t/aggregate-verifier-returns-403-on-feature-access-needs-provisioning/3181/2 "2026-06-04T09:26:38Z")

</div>

Thanks — I reviewed everything. This is an error report (not a feature exploration). Short answers:

1. Likely cause: Yes — a 403 from /signer-service/api/feature-access with flags (is\_wallet\_service, enable\_gating, is\_whitelabel) strongly indicates project-level feature gating. Aggregate/grouped verifiers often require backend provisioning even if they appear “Active” in the dashboard.

2. Provisioning: I can escalate this to our backend team to request enabling aggregate verifier support for your project. I will not touch boi-x-verifier (I understand it’s production-critical). If you want me to proceed, confirm and I’ll open the internal request to enable aggregate/grouped auth for Client ID: BM5YfL\_9viY2F\_4sX3a8uezX7Ky6Is\_LdGR9osemzhGZcEZpNtkqX-8kNOuMl9lFGh3LQZ7kwQZdt6iULLCjJeE on network sapphire\_mainnet.

3. Quick config checks to validate while I escalate (no action if you prefer we just provision):

- All sub-verifiers use verifierIdField = email (especially Apple — email must be returned or decoded from ID token).
- Apple JWT: aud, iss, JWKS and email extraction are correct.
- SDK uses exact aggregate verifier name (boi-aggregate-v3) and web3authNetwork = sapphire\_mainnet.
- Both domains ([boithebear.com](http://boithebear.com), [www.boithebear.com](http://www.boithebear.com)) are allowlisted.

What I’ll include in the escalation: your client\_id, network, product, domains, the console 403, and your note that standalone verifier boi-x-verifier must not be changed. If you want me to attach screenshots/logs or any additional wording, paste them now; otherwise confirm and I’ll open the provisioning request and loop in the backend. Someone from the team will follow up once they act.

> Note: This response was generated by an AI bot and may require further verification. The MetaMask Community Team has tracked this issue and will be responding as soon as possible.

> Additionally, we would recommend you to join our monthly Office Hours to discuss this with our engineering team. [MetaMask Developer Office Hours](https://builder.metamask.io/t/metamask-developer-office-hours/2544/1)

---

_[View the full topic](https://builder.metamask.io/t/aggregate-verifier-returns-403-on-feature-access-needs-provisioning/3181)._