Troubleshooting: voice-model credential rejected

This page owns the 422 VOICE_CREDENTIAL_PROVIDER_REJECTED response on the voice-model credential write surface — both PUT /api/v1/voice/voice-provider-credential/{kind} (register) and POST /api/v1/voice/voice-provider-credential/{kind}/rotate (rotate). The code fires when the upstream TTS or STT provider refuses the credential you submitted before Orbit persists it.

Why registration returns a 422

Both register and rotate probe the credential live against the provider you named. If the provider answers with a 401, 403, or any other refusal that means “this key is not valid,” the call returns VOICE_CREDENTIAL_PROVIDER_REJECTED and nothing is written — the bad key never reaches your organization settings, never becomes active, and never gets enforced. This is deliberate: a credential that downstream services (STT playground comparisons, on-call transcription, TTS synthesis) would reject on every use is caught at the control plane instead. The supported providers per kind are:

Kind	Provider	Where the key comes from
`tts`	Cartesia	Your Cartesia dashboard
`stt`	Deepgram	Your Deepgram dashboard

Cause table

Symptom	Likely cause	Fix
`VOICE_CREDENTIAL_PROVIDER_REJECTED` immediately after pasting a key	Key is invalid, expired, or was pasted with stray whitespace	Re-copy the key from the provider dashboard and retry
The key worked yesterday but fails today	The provider key was revoked or rotated on the provider side	Generate a new key in the provider dashboard and rotate it in
The key works in the provider’s own console but fails here	The key exists but lacks the scope the voice call needs (for example, a Deepgram key without transcription scope, or a Cartesia key without speech synthesis scope)	Re-issue the key with the required permissions, or use the platform-owned key
Only one kind fails	You are registering an STT key under TTS or vice versa	Submit the key under the correct `kind`

Fix the credential

Open the provider dashboard where the key was created (Cartesia for TTS, Deepgram for STT).
Confirm the key is active and has the required permissions for the kind you are registering.
If the key is revoked, expired, or scope-restricted, create a replacement key there.
Re-copy the key directly from the provider dashboard — avoid pasting through a chat window or document, which can add whitespace.
Retry the registration or rotation in Settings → Voice or through the API.

If you no longer want to manage a provider key, revoke the existing credential instead of rotating it; voice traffic for that kind then falls back to the platform-owned key.

Retry-safety

Do not retry the same payload in a loop. VOICE_CREDENTIAL_PROVIDER_REJECTED is a deterministic provider verdict — the provider will refuse the same credential every time until you replace it. Fix or replace the key first, then submit once.

Envelope sample

{
  "error": {
    "code": "VOICE_CREDENTIAL_PROVIDER_REJECTED",
    "message": "Cartesia rejected this credential (HTTP 401). Check the key in your provider dashboard and try again.",
    "status": 422,
    "details": {
      "kind": "tts",
      "provider": "cartesia",
      "provider_status": 401
    }
  },
  "meta": {
    "request_id": "req_vpc_rejected_1",
    "timestamp": "2026-10-04T09:15:00.000Z"
  }
}

Ticket checklist

Only escalate after you have replaced or revoked the key and the same call still returns VOICE_CREDENTIAL_PROVIDER_REJECTED:

The code (VOICE_CREDENTIAL_PROVIDER_REJECTED) and the endpoint (PUT /api/v1/voice/voice-provider-credential/{kind} or POST /api/v1/voice/voice-provider-credential/{kind}/rotate).
The kind and provider from error.details.
The provider HTTP status (error.details.provider_status) — 401, 403, or another value.
Your organization ID.

Reference

Troubleshooting: voice-model credential rejected

Troubleshooting: voice-model credential rejected

Why registration returns a 422

Cause table

Fix the credential

Retry-safety

Envelope sample

Ticket checklist

See also

​Troubleshooting: voice-model credential rejected

​Why registration returns a 422

​Cause table

​Fix the credential

​Retry-safety

​Envelope sample

​Ticket checklist

​See also

Troubleshooting: voice-model credential rejected

Why registration returns a 422

Cause table

Fix the credential

Retry-safety

Envelope sample

Ticket checklist

See also