I was creating agents via API calls with the private key. Later I added a public key restricted to my website so the agents could run there. After that change, the Vapi dashboard lost permission to talk to those same agents and started throwing “Key doesn’t allow origin dashboard.vapi.ai”. I resolved it by adding a new public key that explicitly allows the dashboard domain. Might be worth noting in the docs or considering default dashboard access (with or without keys) so this doesn’t confuse others..

To ensure the Vapi dashboard can access your agents, include

dashboard.vapi.ai

in the

allowedOrigins

when generating your public key. Here's an example payload for your JWT token:

js
const payload = {
  orgId: process.env.ORG_ID,
  token: {
    tag: "public",
    restrictions: {
      enabled: true,
      allowedOrigins: [
        "https://yourwebsite.com",
        "https://dashboard.vapi.ai"
      ]
    }
  }
};

This will allow both your website and the dashboard to interact with your agents without origin errors. [See JWT authentication docs for more details.](https://docs.vapi.ai/customization/jwt-authentication) Source: - [JWT Authentication](https://docs.vapi.ai/customization/jwt-authentication)

I’ve fixed it just wanted to inform the vapi team since this seems like a confusing but easily fixable issue. I just added another key to allow the vapi domain access to agents.

Glad you were able to get this resolved. If anything else comes up or you need further assistance, we’re here to help.

Thanks for pointing this out, this is a common source of confusion. I can help review your key setup and domain restrictions so both your website and the Vapi dashboard have seamless access to agents. Have you also considered setting up separate keys for each environment to prevent conflicts in the future? @Marc2020