Created public API Keys with transient assistant checked (or not), always get 403 "Key doesn't allow transient assistant on https://api.vapi.ai/call/web how to fix it?

Hi there, Thank you for your message. Our team is currently out of the office. We operate Monday through Friday, from 9:00 AM to 8:00 PM Pacific Standard Time (PST). We’ll get back to you as soon as possible during our normal business hours. If your message is urgent, please mark it accordingly or include “URGENT” in the subject line, and we’ll do our best to respond promptly. Warm regards, Vapi Customer Support Team

To fix the 403 error, ensure your public API key's JWT token includes the

allowTransientAssistant: true

restriction. Here’s an example payload for generating a public JWT token that allows transient assistants:

js
const payload = {
  orgId: process.env.ORG_ID,
  token: {
    tag: "public",
    restrictions: {
      enabled: true,
      allowedOrigins: ["https://your-app.com"],
      allowedAssistantIds: [],
      allowTransientAssistant: true, // <-- must be true
    },
  },
};

Regenerate your token with this payload and use it for your web calls. This should resolve the permission issue for transient assistants on

/call/web

([documentation](https://docs.vapi.ai/customization/jwt-authentication)). Source: - [JWT Authentication](https://docs.vapi.ai/customization/jwt-authentication)

i tried with api key directly, not working. Now i used JWT, same problem occurs! https://cdn.discordapp.com/attachments/1421594153019641876/1421599104823197726/Screenshot_2025-09-27_at_2.46.52_p.m..png?ex=68d99ed6&is=68d84d56&hm=276cc6be5b9d72dffbbf578248ab8ee1fd11cf0b6510ebf657da9fa900bed3db&

Hi EMILIANOM, On why you're getting the 403 "Key doesn't allow transient assistant" error. The issue is related to permissions and configuration of your public API key. When using transient assistants (inline assistant configurations), you need to specifically enable this permission. From the documentation, when creating a public JWT token or API key, you need to set

allowTransientAssistant

to

true

in the restrictions. Here's how to fix it: If using JWT, configure your token like this:

{
  "orgId": "your-org-id",
  "token": {
    "tag": "public",
    "restrictions": {
      "enabled": true,
      "allowTransientAssistant": true,
      "allowedOrigins": [
        "https://example.vapi.ai"
      ]
    }
  }
}

If using a public API key from the dashboard: 1. Go to your Vapi Dashboard 2. Navigate to API Keys section 3. Create a new public key or edit existing one 4. Make sure to enable the "Allow Transient Assistant" permission Alternatively, instead of using a transient assistant configuration, you could: 1. Create a permanent assistant in your dashboard 2. Use the assistant ID in your requests instead of inline configuration 3. Use assistantOverrides to modify any dynamic values

I did enabled it, but there is a bug on your side trust me

Could you also share the request payload you are using?