Of course you are in the right channel to ask for help Sounds like the token just isn’t being stored at the session level after OTP verification. If Vapi doesn’t explicitly save the auth_token from the backend response, the model will just generate one on the next call. You need to capture the verify response, store the token in a session variable, and inject it into headers for protected routes. I’ve fixed this exact OTP → token → protected flow before. If you share how you’re handling the verify step, I can quickly spot where it’s going wrong @Vanator