blocked_target: the target address is not permitted

Common causes

• The URL points at localhost, 127.0.0.0/8, ::1, or a RFC1918 range such as 10.0.0.0/8 or 192.168.0.0/16.
• The hostname resolves to the cloud metadata address 169.254.169.254, directly or through an IPv4-mapped IPv6 form.
• The target uses a decimal, octal or hexadecimal IP encoding intended to slip past blocklists.
• A hostname you believe is public resolves to a private address, often through split-horizon DNS.

How to fix it

1. 01Resolve the hostname yourself (dig +short) and confirm every answer is a public address.
2. 02If the target is genuinely internal, it cannot go through the relay — call it from your own network instead.
3. 03Do not retry a blocked_target error: the same target will be refused every time.

What it looks like

curl -sS https://backfireapi.base44.app/functions/forward \
  -H "Authorization: Bearer $BACKFIRE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/","method":"GET"}'

# {
#   "ok": false,
#   "error": { "code": "blocked_target", "message": "..." },
#   "quota": { "remaining": 5000 }
# }

Every error code