Here’s the short Discord-ready breakdown you can drop in support: --- I only have one webhook credential set up — a custom Bearer token — and it’s selected at both my Org and my Phone Number in the Vapi dashboard. But when calls come in, my server logs show:

[verifyVapi] 401 tails { expectedTail: '25c3', providedTail: '9e40', mode: 'x-secret' }

We also added debug logging on the transient assistants we return, and they have no

server

or headers. Example:

[assistant-payload][debug] { server: null, fnServers: [] }

So the only credential configured is Bearer (…25c3), but Vapi is still sending an

X-Vapi-Secret …9e40

header on every webhook. That phantom secret doesn’t exist anywhere in our config, so our server rejects it with 401 and transfers fail. Looks like a leftover legacy

server.secret

on our org from before you removed it in May 2025. Can you please clear it so Vapi only uses the Bearer credential we’ve configured? App:

vocly

(Fly.io) #webhooks

Hi go4anthony, It seems your server is receiving a phantom

X-Vapi-Secret

header that is causing the 401 errors, even though you have configured only a Bearer token for authentication. To resolve this, check the following: 1. Ensure there are no legacy secrets or configurations lingering in your Vapi setup. Vapi may include multiple authentication credentials if they exist at different levels (e.g., tool call-level or organization-level). 2. Review your organization-level API Keys page in the Vapi dashboard to clear any unnecessary configurations or deprecated secrets. 3. Confirm that your webhook settings in the Vapi dashboard are solely configured to use the Bearer token, as intended. For more detailed instructions, refer to [Server Authentication](https://docs.vapi.ai/server-url/server-authentication) documentation which outlines how credentials should be organized and prioritized. This includes guidance on removing outdated secrets and maintaining the correct setup. This approach should help eliminate the unwanted headers and ensure your webhooks authenticate properly.