Vapi is the Voice AI platform for developers.

Vapi AI

When creating a public api key, we can set allowed origin. It's working when a set specific origin like `https://saleshoodqa.learning-stage.saleshood.com`
However, when i try set a wildcard like `https://*.learning-stage.saleshood.com`, the key is created but when using it. It will create an error below:
{message: "Key doesn't allow origin 'https://saleshoodqa.learning-stage.saleshood.com'.", error: 'Forbidden', statusCode: 403}

<@&1231325148079194222> Can anyone help me with this problem? Thank you

You can continue this conversation by mentioning me in the message.

<@832101740580306974>
It seems like there might be an issue with the way the wildcard origin is being interpreted by the system. Wildcard support for allowed origins can vary depending on how the API is configured to handle CORS (Cross-Origin Resource Sharing) policies.

To address this issue, you should ensure that the API is configured to accept wildcard subdomains properly. If the configuration seems correct but the problem persists, it could be a limitation or a bug within the API's handling of wildcard origins.

For now, as a workaround, you might need to specify each subdomain explicitly in the allowed origins if the wildcard functionality is not working as expected. If this is not feasible or if you require the wildcard functionality to work correctly, please reach out to the support team for further assistance. They may need to investigate the issue more deeply or provide a fix.

Would you like me to assist you with anything else regarding this matter?

Got it. Tagging <@&1231325148079194222> for additional help.

<@832101740580306974> can you share your orgId?

Here is our aea91372-fc8a-424e-8b6f-ce77bb84c639

hi <@&1231325148079194222> can we get an update on this problem. Thank you.

<@832101740580306974> can you share the error payload, because I can see the allowed origins.

```json
    "restrictions": {
      "allowedOrigins": [
        "https://*.learning-stage.saleshood.com"
      ]
    }
```

the allowed origins is correct, but when we call it from saleshoodqa.learning-stage.saleshood.com, it does not work withe the error here: {message: "Key doesn't allow origin 'https://saleshoodqa.learning-stage.saleshood.com/'.", error: 'Forbidden', statusCode: 403}