Answer
This is a CORS (Cross-Origin Resource Sharing) restriction — direct browser access to API documentation is only supported for CORS-enabled environments/origins, and a browser accessing it from an unrelated local origin gets blocked with a 403. Modern browsers all enforce this, but tools like Postman don't apply the same CORS restriction, so testing the same request in Postman is a good way to confirm this is the cause; if Postman instead returns a 401, that's a separate, ordinary authorization issue requiring proper credentials rather than a CORS problem.