The fix: add a browser-style User-Agent header (e.g. Mozilla/5.0) to every Vapi API request. Without it, Cloudflare in front of Vapi returns 403 error code: 1010 regardless of your API key.

Symptom

Every request to api.vapi.ai returns HTTP 403 with body error code: 1010. The API key is valid; the same call works from Postman but fails from your server, cron job, or n8n Code node.

Why it happens

Cloudflare's bot protection scores requests with missing or non-browser User-Agent strings as automated abuse (1010 = "the owner of this website has banned your access based on your browser's signature"). Server-side HTTP clients often send no UA at all.

The fix

headers: {
  "Authorization": "Bearer YOUR_VAPI_KEY",
  "Content-Type": "application/json",
  "User-Agent": "Mozilla/5.0"
}

How we hit it

A production n8n workflow creating assistants dynamically: worked from local testing tools, returned 1010 from the server. One header ended a two-hour debugging session.

Verify

The same request with the UA header returns your normal 200/201 response immediately.

Related landmines

Vapi 400 "property tools should not exist" · All Vapi landmines

We run production voice-agent stacks white-label for agencies. What we build →