Thread Discussion

Hey all,
I'm trying to let logged-in membership users update their associated Retirement Plan (custom object) info from a form on the /my-account page. I'm using a serverless function and making a PATCH request with the correct token (which works in Postman), but still getting a 403 Forbidden error when calling it from frontend JS (module_retirement-plan-information.js).
Error:

POST /_functions/update-retirement-plan 403 (Forbidden)
Exception: SyntaxError: Unexpected token 'R', "Request Forbidden" is not valid JSON

Is this expected behavior when calling a serverless function from a membership page even when the user is authenticated?
And is there a secure or recommended way to submit a form and update associated custom object properties (Retirement Plan) from a HubSpot membership page?
Would appreciate any insight or recommended approach