Filament 4 panel returns 403 in production but works locally. Why?

Locally, Filament lets any authenticated user into the panel. In any environment other than local, your User model must implement FilamentUser and return true from canAccessPanel(). Without that, Filament responds with 403.

use Filament\Models\Contracts\FilamentUser;
use Filament\Panel;

class User extends Authenticatable implements FilamentUser
{
    public function canAccessPanel(Panel $panel): bool
    {
        return $this->is_admin;   // or str_ends_with($this->email, '@yourcompany.com') && $this->hasVerifiedEmail()
    }
}

Check $panel->getId() if you run several panels with different audiences:

return match ($panel->getId()) {
    'admin' => $this->hasRole('admin'),
    'app'   => true,
    default => false,
};

Other causes of 403/blank pages in production

• APP_ENV=production with a user missing the flag or role you check.
• Filament assets not published: run php artisan filament:upgrade (done by Composer post-update scripts normally) and php artisan filament:assets if styles or scripts return 404.
• Config or route caching with stale values: php artisan optimize:clear, then php artisan optimize.
• Policies: if a resource has a policy, viewAny must return true for that user, otherwise the resource is hidden or returns 403.
• Wrong SESSION_DOMAIN or SESSION_SECURE_COOKIE behind a proxy, which looks like being logged out instead of 403.

After deploying run php artisan filament:optimize (Filament 4) to cache components and icons for speed.