I also get a 403 forbidden error when trying to call my FastAPI backend, but presume that's because the user is logged in but not yet verified.

Hey. If the user is not logged in, you get a 401 error. Not 403.

Thanks - would I get a 403 error if the user is logged in but hasn't verified their email yet?

Yes.