A 403 error can occur for any of the following reasons. A fiddler capture may be required to investigate further.
The user has exceeded the amount of embed token that can be generated on a shared capacity. Purchase Azure capacities to generate embed tokens and assign the workspace to that capacity. See Create Power BI Embedded capacity in the Azure portal.
The Azure AD auth token expired.
The authenticated user isn't a member of the group (workspace).
The authenticated user isn't an admin of the group (workspace).
The authenticated user doesn't have permissions. Permissions can be updated using refreshUserPermissions API
The authorization header may not be listed correctly. Make sure there are no typos.