Realtime /v1/realtime/calls suddenly failing with 401 ip_not_authorized despite static Cloud Run IP being allowlisted

API Bugs
1

Hi everyone,

We have a production Realtime WebRTC flow that has been working every day for around two months. Yesterday it suddenly started failing, and I’m trying to understand whether this could be an OpenAI-side IP allowlist enforcement issue.

Our setup:

  • Firebase / Cloud Run function get_realtime_api_session uses OPENAI_API_KEY from Secret Manager server-side.

  • It calls /v1/realtime/client_secrets and successfully receives a client_secret.value ephemeral token starting with ek_....

  • Flutter then creates the WebRTC SDP offer.

  • Flutter sends { sdp, ephemeral_token } to our create_realtime_sdp_call Cloud Function.

  • That function calls:

POST https://api.openai.com/v1/realtime/calls
Authorization: Bearer <ephemeral ek_ token>
Content-Type: application/sdp

The SDP function then suddenly started receiving this from OpenAI:

{
  "error": {
    "message": "Your IP is not authorized to make this request.",
    "type": "invalid_request_error",
    "code": "ip_not_authorized",
    "param": ""
  }
}

The confusing part is that nothing changed on our side before this started happening:

  • Same OpenAI project.

  • Same API key setup.

  • Same Firebase / Cloud Run project.

  • Same Cloud NAT / VPC setup.

  • Same static outbound IP.

  • Same project-level IP allowlist coverage.

  • The Cloud Function had not been redeployed before the issue started.

We added debug logs to verify the request:

  • sdp is present.

  • ephemeral_token is present and starts with ek_....

  • The Cloud Function’s outbound IP was checked from inside the function.

  • That outbound IP matches the IP in the OpenAI project-level allowlist.

  • Cloud Run is configured to route all outbound traffic through the VPC/NAT.

  • The allowlist coverage is attached to the correct OpenAI project.

Most importantly:

IP allowlist OFF → the same Realtime WebRTC flow works.
IP allowlist ON → the same flow fails with 401 ip_not_authorized.

So this does not look like a Flutter/WebRTC issue, an invalid SDP issue, or a missing ephemeral token issue. It looks like /v1/realtime/calls is not recognizing the project-level allowlisted IP, even though the outbound IP is verified and the project coverage appears correct.

Has anyone else seen ip_not_authorized suddenly start happening on /v1/realtime/calls, especially when using ephemeral ek_... Realtime tokens?

Could OpenAI have changed IP allowlist enforcement for the Realtime WebRTC calls endpoint recently, or is there another project/org-level setting that could cause /v1/realtime/client_secrets to work but /v1/realtime/calls to fail?

Any guidance would be appreciated because this is affecting production.

2

Thanks for documenting the checks you’ve already done. Getting the temporary token works, but starting the call fails when IP allowlisting is enabled. That narrows the investigation to the IP authorization check, although we haven’t confirmed why this request is being rejected. If this is still happening, please share one recent failed call’s x-request-id and UTC time so we can trace the request and identify the root cause.