Thanks — I hear you: the token worked locally but fails after deployment to Vercel + LiveKit Cloud, and the error messages are ambiguous. Let’s focus on the most likely causes and get you the minimum info I need to diagnose it quickly. What to check first (most common causes) • Environment variables: Confirm these are set in your Vercel project exactly as in your LiveKit Cloud project: ◦

LIVEKIT_API_KEY

◦

LIVEKIT_API_SECRET

◦

LIVEKIT_URL

Local .env files are not used in Vercel — these must be configured in the Vercel dashboard. • API key / secret mismatch: Ensure the keys/secrets in Vercel match the LiveKit Cloud project you intend to use. A mismatch will cause signature verification to fail. • Token TTL and claims: Make sure your token’s expiration (

exp

) and not-before (

nbf

) are sensible (positive TTL). A token that’s already expired or has incorrect TTL will be rejected. • Clock skew: The deployed server’s clock must be correct. If the deployment environment clock is off, tokens can appear “not valid yet” or “expired.” • Token endpoint behavior: Verify your deployed token endpoint is actually returning a token (not an error HTML page or JSON error). Call the endpoint directly (curl or Postman) on the deployed URL and inspect the response. • Inspect the token: Copy the JWT and decode it (e.g., jwt.io) to check

iss

,

nbf

,

exp

, and permissions like

video.roomJoin

. Quick diagnostic steps you can run now 1. From your local machine, call the deployed token endpoint: ◦ curl https://your-deployed-endpoint/token ◦ Confirm the response is a JWT string (not an error page, HTML, or JSON error). 1. If you get a token back, paste the token into a JWT decoder and check: ◦

iss

matches your API key ◦

exp

is in the future ◦

nbf

is <= current time ◦ contains required grants (e.g.,

video.roomJoin

) 1. If the endpoint returns an error or no token: ◦ Check Vercel logs for the serverless function that generates tokens to see runtime errors or missing env vars. 1. If token appears valid but connection fails: ◦ Confirm

LIVEKIT_URL

in env is the correct LiveKit Cloud URL (and uses https if required). ◦ Confirm that the client is using the same LiveKit project / URL as the token. Questions so I can help further • What exact error message do you see in the browser console or server logs when the token request fails? Copy-paste if possible. • Do you get an HTTP error from the token endpoint (status code and body)? Or does the endpoint return a token that then fails on connect? • Did you set the three env vars (

LIVEKIT_API_KEY

,

LIVEKIT_API_SECRET

,

LIVEKIT_URL

) in Vercel? If so, can you confirm they match your LiveKit Cloud project (don’t paste secrets — just confirm whether they’re the same as local)? • Are you generating tokens on a serverless route (API route) in Vercel or from a separate backend server? • Can you paste (or describe) the token generation code snippet you’re using (remove secrets)? What I can do next for you • Walk through targeted checks once you share the error text and whether the token endpoint returns a JWT. • Help inspect a decoded token if you paste the token payload (don’t share secrets; just the decoded payload). • If the token endpoint is returning an error, I can walk you through reading Vercel function logs and the likely fixes. If you send the error text and confirm how you’re generating tokens in deployment (Vercel API route vs separate server), I’ll give step-by-step fixes tailored to your setup. Sources: Troubleshooting 401 Unauthorized and Token Errors | LiveKit | server-sdk-js | livekit/livekit_composite | DeepWiki | examples/drive-thru | livekit/livekit_composite | DeepWiki | Self-hosted deployments | LiveKit Documentation | Deploy LiveKit Agents with GitHub Actions | LiveKit, with interactive elements