JWT broken

S

still-limeOP•5/12/25, 5:21 AM

keep getting Error: {"message":"Couldn't verify JWT.","error":"Unauthorized","statusCode":401}

V

Thank you for sharing the details about the issues you're experiencing with JWT creation and the changes to the documentation link. I understand how frustrating it can be when something that was working suddenly stops, especially with error messages like the one you're seeing for the Allowed Origins field. Your feedback about the regex validation and the broken documentation link is valuable, and it's clear you've provided helpful details about what you're encountering.

⤵️ Mention @Vapi Support Bot for follow-ups 🐥

V

Vapi Support BotAPP•5/12/25, 5:22 AM

Thank you for sharing the details about the issues you're experiencing with JWT creation and the changes to the documentation link. I understand how frustrating it can be when something that was working suddenly stops, especially with error messages like the one you're seeing for the Allowed Origins field. Your feedback about the regex validation and the broken documentation link is valuable, and it's clear you've provided helpful details about what you're encountering.

⤵️ Mention @Vapi Support Bot for follow-ups 🐥

V

Vapi Support BotAPP•5/12/25, 5:22 AM

I'm sorry to hear you're experiencing issues with JWT creation and the regex validation for allowed origins, especially since everything was working fine just a couple of days ago. It can be really frustrating when things suddenly stop working and documentation links are broken. Thank you for sharing the details and the error message—hopefully these issues get resolved soon.

V

Vapi Support BotAPP•5/12/25, 5:22 AM

I'm sorry to hear you're experiencing issues with JWT creation and the regex validation for allowed origins, especially since everything was working fine just a couple of days ago. It can be really frustrating when things suddenly stop working and documentation links are broken. Thank you for sharing the details and the error message—hopefully these issues get resolved soon.

S

still-limeOP•5/12/25, 5:22 AM

when my private key, org id, public key along with the format is exactly how it should be

S

SarthakAPP•5/13/25, 2:28 AM

## Problem:

The validation regex in the private API key creation form is rejecting

http://localhost:3000/

http://localhost:3000/

http://localhost:3000/

http://localhost:3000/ URLs, showing "Please enter a valid regex URL" error. This prevents creating a private API key for local development, which then causes JWT authentication to fail with a 401 Unauthorized error.

Why it's occurring:

The URL validation function is designed specifically for production domain names and wildcard subdomains, not localhost. The regex pattern explicitly requires.

This pattern:

1. Expects a hostname with a dot separator (e.g.,

example.com

example.com

)

2. Requires a TLD of 2-6 characters after the dot (`.com`,

.org

.org

.org

.org, etc.)

3. Was never intended to validate localhost or IP addresses

The validation is working as designed for production domains, but doesn't accommodate local development environments. This is an intentional security constraint since JWTs generated with private keys should be using production domains in real-world scenarios.

For local testing, you need to use a service like ngrok to create a public URL.

A

abstract-purple•5/16/25, 2:34 PM

why for local teesting we should go via public url, it should be fixed

A

abstract-purple•5/16/25, 2:36 PM

getting this error

Body: {
"message": "JWT doesn't permit access. Hot tip, you may be missing

token

token

token

token in your JWT.",
"error": "Unauthorized",
"statusCode": 401
}

even after putting the correct private api key and org id as said, please help, tried passing via Bearer as well

S

SarthakAPP•5/17/25, 7:17 AM

Hey,

Could you please schedule a brief call at your convenience so we can discuss this matter in detail?

Kindly use the following link to book a suitable time: https://calendly.com/shubham-vapi/chat-30m.

A

abstract-purple•5/17/25, 11:37 AM

Thanks a lot for reaching out for support, but all the slots till next month 20th june are totally booked

S

SarthakAPP•5/20/25, 1:20 AM

can you please provide your org id so I can investigate the logs?

A

abstract-purple•5/20/25, 4:49 PM

8b6f6c1e-419c-4820-bf36-5b84044af904

A

abstract-purple•5/20/25, 4:51 PM

still facing the same problem, tried creating new private api key allowing the my produciton host, still same issue

A

abstract-purple•5/20/25, 4:57 PM

Error: Status code: 401
Body: {
"message": "JWT doesn't permit access. Hot tip, you may be missing

token

token

token

token in your JWT.",
"error": "Unauthorized",
"statusCode": 401
}

A

abstract-purple•5/20/25, 5:29 PM

no worries, figured out it was due to the scope

but public doc of jwt is still giving 404, had to go history of git document

S

SarthakAPP•5/20/25, 10:33 PM

should work now https://docs.vapi.ai/customization/jwt-authentication

T

technical-ivory•6/16/25, 2:42 PM

Hey team

When running my app locally, the API calls fail (even though using the official @Vapi-ai/server-sdk). I'm trying to retrieve assistants / calls / phone numbers. It is because I'm running this from my localhost, and your security doesn't allow JWT tokens from the private API key ? It does work in my pre-production and production environments.

S

SarthakAPP•6/17/25, 2:42 PM

Are you using private token to generate the JWT?

T

technical-ivory•6/18/25, 1:00 PM

Yes, private taken

T

technical-ivory•6/18/25, 1:01 PM

Actually using the private key to call the API, not even generating jwt sorry. Simply calling the API via the server sdk. "fetch failed" when trying from my local machine

S

SarthakAPP•6/19/25, 9:18 PM

Can you send me your reproducible code sample repository in DM?

Why it's occurring:

Similar Threads

Similar Threads

Similar Threads

Why it's occurring: