Hi Sten,

Since list() works but every actual download returns 403, I’d first rule out the export script before treating it as a store-level block.

Instead of fetching the public blob URL directly and manually adding an Authorization header, try one test using the Blob SDK’s get() method for a single file. That is the SDK method intended to stream blob content:

1
import { list, get } from '@vercel/blob'
2

3
const { blobs } = await list({
4
  limit: 1,
5
  token: process.env.BLOB_READ_WRITE_TOKEN,
6
})
7

8
const blob = blobs[0]
9

10
const result = await get(blob.pathname, {
11
  access: 'public', // change to 'private' if the blobs were uploaded as private
12
  token: process.env.BLOB_READ_WRITE_TOKEN,
13
})
14

15
console.log({
16
  pathname: blob.pathname,
17
  statusCode: result?.statusCode,
18
  hasStream: Boolean(result?.stream),
19
})
20

If list() succeeds but get() and the blob downloadUrl both return 403 for every object, then it probably is not a pathname or auth-header bug in your script. At that point, the useful details to include in a support request are:

1
Blob listing succeeds with BLOB_READ_WRITE_TOKEN
2
Blob downloads fail with 403
3
Blob Data Transfer is over the Hobby limit
4
Goal is one-time export/migration, not continued production serving
5
One example pathname, with any private parts removed
6

Do not post the BLOB_READ_WRITE_TOKEN or any signed/private URLs publicly.

One thing to confirm: were the blobs originally uploaded with access: 'public' or access: 'private'?

Thanks. I ran the SDK get() test.

list() succeeds with my BLOB_READ_WRITE_TOKEN and returns a valid blob:

1
pathname: uploads/1776246362286-1903py0p.webp
2
url: https://uqxeg7dnxqalmhab.public.blob.vercel-storage.com/uploads/1776246362286-1903py0p.webp
3
downloadUrl: https://uqxeg7dnxqalmhab.public.blob.vercel-storage.com/uploads/1776246362286-1903py0p.webp?download=1
4
size: 13656
5

Then I tested both SDK access modes:

1
get() with access="public" failed
2
{
3
  name: 'Error',
4
  message: 'Vercel Blob: Failed to fetch blob: 403 Forbidden',
5
  status: undefined
6
}
7

8
get() with access="private" failed
9
{
10
  name: 'Error',
11
  message: 'Vercel Blob: Failed to fetch blob: 403 Forbidden',
12
  status: undefined
13
}
14

The blob URL is on .public.blob.vercel-storage.com, so it appears to be a public blob. Since list() works but both direct public reads and SDK get() reads fail with 403, this looks like a Blob read/download block rather than a pathname, access-mode, or script issue.

My Blob Data Transfer is currently over the Hobby limit at 10.8 GB / 10 GB. I only need temporary access to export/migrate the existing files to another storage provider.

Could Vercel temporarily unblock Blob reads/downloads for this store so I can complete the migration?

Hi Sten,

Thanks for testing that — that basically rules out the script, pathname, and public/private access mode as the cause.

Since:

1
list() succeeds
2
the blob URL is on .public.blob.vercel-storage.com
3
direct public URL reads return 403
4
SDK get() with public and private both return 403
5
Blob Data Transfer is over the Hobby limit
6

…I don’t think there’s much more to debug from the app/code side. This looks like a platform-side usage-limit block on blob reads/downloads.

For completeness, you could add one CLI test to the support details:

1
vercel blob get "https://uqxeg7dnxqalmhab.public.blob.vercel-storage.com/uploads/1776246362286-1903py0p.webp" --output test.webp
2

If that also returns 403, your repro is very clear: the store can still list metadata with the token, but no blob content can be retrieved by URL, SDK, or CLI.

I don’t have any way to temporarily unblock the store from the community side, so this needs Vercel support/staff intervention. I’d send them exactly the concise summary you posted here, plus one example pathname/URL and the fact that the goal is a one-time export/migration, not continued production traffic. Don’t include the BLOB_READ_WRITE_TOKEN.

I also tested with the Vercel Blob CLI using the required --access public flag and the read-write token.

Command used:

1
vercel blob get "https://uqxeg7dnxqalmhab.public.blob.vercel-storage.com/uploads/1776246362286-1903py0p.webp" --output test.webp --access public --rw-token [redacted]
2

Result:

1
Vercel CLI 54.13.0 (Node.js 22.2.0)
2
Error: Vercel Blob: Failed to fetch blob: 403 Forbidden
3

So the current repro is:

• list() succeeds with BLOB_READ_WRITE_TOKEN

• The blob URL is public and uses .public.blob.vercel-storage.com

• SDK get() with access: "public" fails with 403 Forbidden

• SDK get() with access: "private" fails with 403 Forbidden

• Direct public URL download fails with 403 Forbidden

• CLI vercel blob get with --access public and --rw-token also fails with 403 Forbidden

• Blob Data Transfer is over the Hobby limit: 10.8 GB / 10 GB

This confirms that the issue is not the script, pathname, access mode, direct URL method, or CLI usage. It appears to be a platform-side Blob read/download block caused by the Hobby data transfer limit.

Hi Sten,

Thanks for confirming the CLI result too. That makes the repro pretty complete.

At this point I’d stop testing different download methods, because all of them are hitting the same behavior:

1
metadata/list access works
2
blob content reads fail
3
public URL fails
4
SDK get() fails
5
CLI get fails
6
usage is over the Hobby Blob Data Transfer limit
7

That lines up with Blob access being blocked because the usage limit has been exceeded, not with a bad script or incorrect access setting. Vercel’s Blob usage docs also say Hobby Blob is usable within the limits, and that access is unavailable after limits are exceeded until the usage window resets.

The next step is probably not more debugging, but a support request from the affected Vercel account/team. I’d keep it very short and include only the repro facts:

1
Need one-time export access for Vercel Blob migration.
2

3
Blob Data Transfer is over Hobby limit: 10.8 GB / 10 GB.
4
list() succeeds with BLOB_READ_WRITE_TOKEN.
5
Public blob URL returns 403.
6
SDK get() with public/private returns 403.
7
vercel blob get with --access public and --rw-token returns 403.
8
Goal is export/migration only, not continued production serving.
9

Do not include the read-write token or any signed/private URLs. If Vercel can’t temporarily unblock the store, the fallback may be waiting for the 30-day usage window to reset and exporting immediately before the app serves more Blob traffic.