https://vapi.ai/ logo
Join Discord
Powered by
key does not allow origin
# support
t
v
To fix the "Key doesn't allow origin" error, update your API key settings to allow the required origin: 1. Go to the Vapi dashboard, navigate to API Keys, and find your key. 2. Edit the key's settings to add 
https://dashboard.vapi.ai
to the list of allowed origins. 3. Save your changes. This will enable the dashboard to use your key without origin errors. Source: - [Web widget documentation](https://docs.vapi.ai/chat/web-widget)
c
Hi Toketo1, this is typically related to CORS (Cross-Origin Resource Sharing) settings for your API key. Here are the steps to resolve this: 1. Go to your API key settings in the Vapi dashboard 2. Add the required domain/origin to the allowed origins list 3. The format should be complete URLs, for example: - 
https://yourdomain.com
- 
https://app.yourdomain.com
- 
http://localhost:3000
(for development) Note: Using 
*
for all origins is not recommended for security reasons. If you're still experiencing issues after updating the origins, verify: 1. The exact domain making the request matches what you've allowed 2. The protocol (http/https) matches 3. The port number matches (if specified)
r
Hi @Vapi Support Bot using the same allowed region and assistant that I'm using while generating the private key but same 403 forbidden error is coming. Please guide
v
Actionable Step: Double-check that your API request includes the correct Authorization header and that your API key allows the exact origin making the request. For example, your cURL command should look like:
Copy code
bash
curl https://api.vapi.ai/tool \
  -H "Authorization: Bearer <your_token>"
If the 403 error persists, ensure the allowed origin in your API key settings matches the request's domain, protocol, and port exactly as shown in the dashboard documentation. Reference: [Vapi API Reference](https://docs.vapi.ai/api-reference/tools/list?explorer=true) Source: - [Vapi API Reference](https://docs.vapi.ai/api-reference/tools/list?explorer=true)
r
@Vapi Support Bot VAPI responded 403: {"message":"Key doesn't allow origin 'undefined'.","error":"Forbidden","statusCode":403} this is the response that i'm getting while generate the request client.PostAsync("https://api.vapi.ai/call/web", content); why it is showing undefined as i set the following payload { "exp": 1764688771, "orgId": "d7ea8f9a-2252-4399-a659-77172202465b", "token": { "tag": "public", "restrictions": { "enabled": true, "allowedOrigins": [ "https://8f9ff5d4ef11.ngrok-free.app" ], "allowedAssistantIds": [ "285b1ba3-6f44-4e80-8d06-d1ede7a92d02" ], "allowTransientAssistant": true } }, "iat": 1764685171 } please help!
v
To fix the "Key doesn't allow origin 'undefined'" error, route your API call through a backend proxy so the Vapi API receives a valid Origin. Here's a quick example using Node.js/Express as a proxy:
Copy code
js
// Backend proxy example
app.post('/vapi-proxy', async (req, res) => {
  const response = await fetch('https://api.vapi.ai/call/web', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${process.env.VAPI_API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(req.body)
  });
  res.status(response.status).send(await response.json());
});
Call your proxy endpoint from your client instead of calling Vapi directly. This avoids CORS/origin issues and keeps your API key secure. See: [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server) Source: - [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server)
r
v
To resolve the "Key doesn't allow origin 'undefined'" error, you must route your API call through a backend proxy. Here’s a quick Node.js/Express example:
Copy code
js
app.post('/vapi-proxy', async (req, res) => {
  const response = await fetch('https://api.vapi.ai/call/web', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${process.env.VAPI_API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(req.body)
  });
  res.status(response.status).send(await response.json());
});
Call your 
/vapi-proxy
endpoint from your client or Postman instead of calling Vapi directly. This will ensure the Vapi API receives a valid request and avoids the origin error. See: [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server) Source: - [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server)
r
i'm already using Postman instead calling vapping directly you can see the previous screenshoot but still same issue is comming, can you please ensure is this token issue or just cors issue.
@Vapi Support Bot @User @User Hi, I hope you’re doing well. I’d like to understand how to initiate a call (web or phone) using a public token for a specific assistant, including how first-message behavior works. I also need the server-side API reference, as I store conversation history in my database.
v
To initiate a call (web or phone) using a public token for a specific assistant, route your request through a backend proxy to securely handle authentication and avoid CORS issues. Here’s a Node.js/Express example:
Copy code
js
app.post('/vapi-proxy', async (req, res) => {
  const response = await fetch('https://api.vapi.ai/call/web', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${process.env.VAPI_API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(req.body)
  });
  res.status(response.status).send(await response.json());
});
Call this 
/vapi-proxy
endpoint from your client, passing the public token and assistant details in the body. This approach also supports handling first-message behavior and storing conversation history on your server. See: [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server) Source: - [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server)
c
This error is expected when calling the API directly from a client without a valid 
Origin
. If you’re making a server-side request (e.g. from Postman, backend code, or cURL), do not use a public/restricted token. Use your private API key instead. If your key is still throwing this error, create a new VAPI API private and public key with the assistants field empty to allow all assistants access. Example working request:
Copy code
curl -X POST "https://api.vapi.ai/call/web" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "assistantId": "YOUR_ASSISTANT_ID"
  }'
2 Views
PreviousNext
Powered by