Allowed Origins restriction is not working
# supportv
vpd
06/26/2025, 10:11 AMHi, I'm trying to understand how to configure origin restriction for web calls and it seems that it's not working now.
For testing purposes I have specifically created a public key with origin pointing to non-existent address https://disabled.ai
Then I use this key to start a web call via https://api.vapi.ai/call/web on my staging and the call is created and working.
Can anyone help to configure this restriction properly?
The example of call id is c7c3f667-3ee9-4662-83a5-5c58a7d7aead
The orgId is bcf07653-c509-4e14-80c4-842b247509a9
Key name is "Disabled Origin"
k
Kings_big💫
06/26/2025, 11:52 AMLooking into it
c
Chiranjeet Mishra
06/30/2025, 6:30 AMHey @vpd we don't support generating JWT tokens with public keys. Instead, you should create public-scoped JWT tokens using your private key.
v
vpd
06/30/2025, 9:36 AM@Shubham Bajaj @Kings_big💫 Hi, I don't quite understand how JWT is related to my issue of restricting the API key origin. I generate API key via https://dashboard.vapi.ai/org/api-keys. Could you elaborate please or point to some example that will allow me to get working origin-restricted API key for my web-client?
c
Chiranjeet Mishra
06/30/2025, 7:57 PMHey VPD, let me check this and get back to you with proper documentation and steps on how to get this done. Apologies, but I'll take a day. I'm having a headache right now, so might not be looking into this immediately.
Chiranjeet Mishra
07/01/2025, 8:12 PMHey, the issue is on our side. I cannot share any ETA with you now without checking with the team. Once I'm done with my complete analysis, I'll report this to the team, and then they will consider it further in their sprint cycle. Until then, I cannot communicate anything regarding ETA.
v
vpd
07/03/2025, 1:45 PMOk, thanks for confirming! If there is any workaround for it I would love to know/use.
c
Chiranjeet Mishra
07/08/2025, 12:07 AMLet me check if what can be resolved using Private API Key signed JWT Tokens.
Chiranjeet Mishra
07/09/2025, 3:59 AMJust an update, we are still checking on those keys. Thank you for your patience
Chiranjeet Mishra
07/11/2025, 8:46 PMUnfortunately, there's no reliable workaround right now. The feature is not working as expected for both API keys and JWT tokens. It requires a DEV Team effort, I cannot give any commitment but I will forward your request to the team.
v
vpd
07/17/2025, 7:47 AMOk, does it mean that now a stranger can take the api key from client code (of any application that uses VAPI) and use it for their own purpose?
c
Chiranjeet Mishra
07/17/2025, 6:39 PMIf your API key is in client-side code, it can be accessed by anyone. Keep your API keys secure and avoid exposing them in public places. Use server-side code for sensitive operations.
v
vpd
07/29/2025, 10:55 PMSorry, but It sounds like an LLM-generated answer. I am looking at official example at https://github.com/VapiAI/client-sdk-web and it tells to use public key in client side code. The only way I see to keep this key on a server-side is through some kind of proxy server or edge function(s). Is it the expected way?
c
Chiranjeet Mishra
07/31/2025, 4:57 PMHey, let me check with our team and get back to you with an update.
Chiranjeet Mishra
07/31/2025, 10:14 PMYou wont need any edge functions or proxy servers as the public key is totally fine having in client side code and intentional. While technically the key is public facing to some degree, worst case scenario is someone initiates a call or chat with your assistant, but you should be able to monitor the call logs for any suspicious activity or usage. If you see anything strange in the logs, please do not hesitate to reach out and we will investigate.
2 Views