When do you get those 403’s? When you try to use the token?
If that is the case: What command do you use in the attempt to access the API? What is the full (include HTTP headers) and precise output you get?
I have no problems with e.g.:
curl -k -H 'PRIVATE-TOKEN: <token>' -X GET http://localhost/api/v4/users