> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting: voice-model credential rejected

> Resolve VOICE_CREDENTIAL_PROVIDER_REJECTED when registering or rotating a bring-your-own TTS or STT provider credential.

# Troubleshooting: voice-model credential rejected

This page owns the `422 VOICE_CREDENTIAL_PROVIDER_REJECTED` response on the
voice-model credential write surface — both `PUT /api/v1/voice/voice-provider-credential/{kind}`
(register) and `POST /api/v1/voice/voice-provider-credential/{kind}/rotate`
(rotate). The code fires when the upstream TTS or STT provider refuses the
credential you submitted before Orbit persists it.

## Why registration returns a 422

Both register and rotate probe the credential live against the provider you
named. If the provider answers with a 401, 403, or any other refusal that means
"this key is not valid," the call returns `VOICE_CREDENTIAL_PROVIDER_REJECTED`
and **nothing is written** — the bad key never reaches your organization
settings, never becomes `active`, and never gets enforced. This is deliberate:
a credential that downstream services (STT playground comparisons, on-call
transcription, TTS synthesis) would reject on every use is caught at the
control plane instead.

The supported providers per kind are:

| Kind | Provider | Where the key comes from |
| - | - | - |
| `tts` | Cartesia | Your Cartesia dashboard |
| `stt` | Deepgram | Your Deepgram dashboard |

## Cause table

| Symptom | Likely cause | Fix |
| - | - | - |
| `VOICE_CREDENTIAL_PROVIDER_REJECTED` immediately after pasting a key | Key is invalid, expired, or was pasted with stray whitespace | Re-copy the key from the provider dashboard and retry |
| The key worked yesterday but fails today | The provider key was revoked or rotated on the provider side | Generate a new key in the provider dashboard and rotate it in |
| The key works in the provider's own console but fails here | The key exists but lacks the scope the voice call needs (for example, a Deepgram key without transcription scope, or a Cartesia key without speech synthesis scope) | Re-issue the key with the required permissions, or use the platform-owned key |
| Only one kind fails | You are registering an STT key under TTS or vice versa | Submit the key under the correct `kind` |

## Fix the credential

1. Open the provider dashboard where the key was created (Cartesia for TTS,
   Deepgram for STT).
2. Confirm the key is active and has the required permissions for the kind you
   are registering.
3. If the key is revoked, expired, or scope-restricted, create a replacement key
   there.
4. Re-copy the key directly from the provider dashboard — avoid pasting through
   a chat window or document, which can add whitespace.
5. Retry the registration or rotation in **Settings → Voice** or through the
   API.

If you no longer want to manage a provider key, revoke the existing credential
instead of rotating it; voice traffic for that kind then falls back to the
platform-owned key.

## Retry-safety

Do not retry the same payload in a loop. `VOICE_CREDENTIAL_PROVIDER_REJECTED`
is a deterministic provider verdict — the provider will refuse the same
credential every time until you replace it. Fix or replace the key first, then
submit once.

## Envelope sample

```json theme={null}
{
  "error": {
    "code": "VOICE_CREDENTIAL_PROVIDER_REJECTED",
    "message": "Cartesia rejected this credential (HTTP 401). Check the key in your provider dashboard and try again.",
    "status": 422,
    "details": {
      "kind": "tts",
      "provider": "cartesia",
      "provider_status": 401
    }
  },
  "meta": {
    "request_id": "req_vpc_rejected_1",
    "timestamp": "2026-10-04T09:15:00.000Z"
  }
}
```

## Ticket checklist

Only escalate after you have replaced or revoked the key and the same call
still returns `VOICE_CREDENTIAL_PROVIDER_REJECTED`:

1. The **code** (`VOICE_CREDENTIAL_PROVIDER_REJECTED`) and the endpoint
   (`PUT /api/v1/voice/voice-provider-credential/{kind}` or
   `POST /api/v1/voice/voice-provider-credential/{kind}/rotate`).
2. The **`kind`** and **`provider`** from `error.details`.
3. The **provider HTTP status** (`error.details.provider_status`) — 401, 403,
   or another value.
4. Your **organization ID**.

## See also

* [Frequently asked questions](/reference/faq) — the voice section covers the
  STT → LLM → TTS pipeline and how BYO voice-model credentials fit in.
* [Transcription, synthesis, and deepfake failures](/troubleshooting/transcription-and-synthetic-voice-failures) —
  runtime failures after a credential is active, including
  `STT_CREDENTIAL_REJECTED` on the STT Playground.
* [Error codes reference](/reference/error-codes) — the full error-code catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.