VAPI is not sending HMAC details into header

spotty-amber · 2025-12-16T14:43:51.373Z

I have created custom authentication with hmac but the webhook log showing that it is sending { "Content-Type": "application/json", "Accept-Encoding": "identity" } and no hmac details being sent

S

spotty-amberOP•12/16/25, 2:44 PM

@Support.Voice-Agent can you respond

V

Vapi Support BotAPP•12/16/25, 2:45 PM

To ensure HMAC headers are sent, double-check that your server configuration references the correct HMAC credential ID. Your config should look like this:

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

Make sure the HMAC credential is properly set up in the dashboard with all required fields (Secret Key, Algorithm, Signature Header). For more details, see the Server Authentication documentation.

Source:

Server Authentication documentation

⤵️ Mention @Vapi Support Bot for follow-ups 🐥

S

spotty-amberOP•12/16/25, 2:45 PM

@Duckie pl respond on this issue

V

Vapi Support BotAPP•12/16/25, 2:46 PM

Thank you for your patience. To help troubleshoot, could you confirm if your server configuration includes the correct

credentialId

credentialId

credentialId

credentialId for your HMAC credential, and that the credential in the dashboard has all required fields (Secret Key, Algorithm, Signature Header) filled in? For reference, your config should look like:

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_hmac_456"
  }
}

You can find more setup details in the Server Authentication documentation.

Could you please confirm if your configuration matches this and the credential is fully set up in the dashboard?

Source:

Server Authentication documentation

S

spotty-amberOP•12/16/25, 2:48 PM

@Duckie Yes, I have "server": {
"url": "https://d2asmpknrm17tj.cloudfront.net/post_vapi_call_completion",
"timeoutSeconds": 30,
"credentialId": "92f3969f-edc1-4e68-95d4-xx"
},

V

Vapi Support BotAPP•12/16/25, 2:49 PM

Suggestion:
Please double-check that your HMAC credential in the dashboard has the "Signature Header" field set (e.g.,

x-signature

x-signature

x-signature

x-signature). If this field is missing or incorrect, Vapi will not send the HMAC header to your webhook.

Example setup:

{
  "server": {
    "url": "https://d2asmpknrm17tj.cloudfront.net/post_vapi_call_completion",
    "credentialId": "92f3969f-edc1-4e68-95d4-xx"
  }
}

{
  "server": {
    "url": "https://d2asmpknrm17tj.cloudfront.net/post_vapi_call_completion",
    "credentialId": "92f3969f-edc1-4e68-95d4-xx"
  }
}

{
  "server": {
    "url": "https://d2asmpknrm17tj.cloudfront.net/post_vapi_call_completion",
    "credentialId": "92f3969f-edc1-4e68-95d4-xx"
  }
}

{
  "server": {
    "url": "https://d2asmpknrm17tj.cloudfront.net/post_vapi_call_completion",
    "credentialId": "92f3969f-edc1-4e68-95d4-xx"
  }
}

Update the credential in the dashboard if needed, then test again.
For more details, see the Server Authentication documentation.

Source:

Server Authentication documentation

S

spotty-amberOP•12/16/25, 2:53 PM

@Duckie Yes, Authentication Type
HMAC
Algorithm
sha256
Signature Header
x-signature
Signature Prefix
vapi_sig
Timestamp Header
x-timestamp
Include Timestamp
Yes
Signature Encoding
hex
Secret Key
**

V

Vapi Support BotAPP•12/16/25, 2:54 PM

Since your HMAC credential and server configuration appear correct, try removing and re-adding the HMAC credential in the dashboard, then update your server config to reference the new

credentialId

credentialId

credentialId

credentialId. Sometimes, re-creating the credential can resolve hidden configuration issues. After updating, test your webhook again to see if the HMAC headers are now included.

For reference, your config should look like:

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "new_cred_hmac_id"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "new_cred_hmac_id"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "new_cred_hmac_id"
  }
}

{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "new_cred_hmac_id"
  }
}

See the Server Authentication documentation for more details.

Source:

Server Authentication documentation

S

spotty-amberOP•12/16/25, 2:54 PM

@Duckie I have tried that also

V

Vapi Support BotAPP•12/16/25, 2:55 PM

Since you have already verified your HMAC credential setup and tried recreating the credential, the next best step is to contact Vapi support directly with your credential ID and webhook details for further investigation. Sometimes, platform-side issues or account-specific settings may require manual review. You can reference your configuration and this issue when reaching out.
For reference, see the Server Authentication documentation.

Source:

Server Authentication documentation

S

spotty-amberOP•12/16/25, 2:58 PM

@1231325148079194222 pl help

S

spotty-amberOP•12/16/25, 3:03 PM

Here is my agent setup @Duckie

message.txt15.29KB

S

spotty-amberOP•12/16/25, 3:09 PM

@Duckie do you see anything wrong in server setup with hmac?

VAPI is not sending HMAC details into header

Similar Threads

Similar Threads

Similar Threads