Put a voice agent in your website or app

VOXA_API_URL=https://voxa.sutrixa.com/api/v1
VOXA_API_KEY=vxa_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
VOXA_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

curl https://voxa.sutrixa.com/api/v1/agents \
  -H "Authorization: Bearer $VOXA_API_KEY"

curl -X POST https://voxa.sutrixa.com/api/v1/calls/outbound \
  -H "Authorization: Bearer $VOXA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"<agent id>","phone":"+919876543210","name":"Priya","about":"Confirm her table for 4 at 8 pm"}'

{ "error": { "code": "agent_not_live", "message": "This agent isn't live. Set it live in Voxa first." } }

{
  "agents": [
    {
      "id": "8c2f…",
      "name": "Front desk",
      "language": "en",
      "voice": "aria",
      "phone_number": "+919429392800",
      "status": "active",
      "live": true,
      "created_at": "2026-10-20T10:00:00Z"
    }
  ]
}

HTTP/1.1 202 Accepted
{ "id": "5b1d…", "status": "queued", "phone": "+919876543210" }

{ "id": "5b1d…", "agent_id": "8c2f…", "phone": "+919876543210",
  "status": "completed", "message": null, "call_id": "e41a…", "created_at": "…" }

// Your server (Node / Express), e.g. POST /voice-call
app.post("/voice-call", async (req, res) => {
  const r = await fetch(`${process.env.VOXA_API_URL}/calls/web`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.VOXA_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      agent_id: process.env.VOXA_AGENT_ID,
      customer: { name: req.user?.name, phone: req.user?.phone },
      context: "Logged-in customer on the booking page",
    }),
  });
  const call = await r.json();          // { call_id, join_url, expires_in, … }
  res.json({ join_url: call.join_url });
});

<!-- Your page -->
<button onclick="talk()">Talk to us</button>
<script>
  async function talk() {
    const { join_url } = await fetch("/voice-call", { method: "POST" }).then((r) => r.json());
    window.open(join_url, "voxa-call", "width=420,height=640");
  }
</script>

{
  "calls": [
    {
      "id": "e41a…",
      "call_ref": "f7c0…",
      "agent_id": "8c2f…",
      "channel": "phone",            // phone | web | test
      "direction": "inbound",        // inbound | outbound
      "customer_phone": "+919876543210",
      "agent_phone": "+919429392800",
      "duration_seconds": 95,
      "outcome": "completed",
      "cost_cents": 19,
      "started_at": "…",
      "ended_at": "…",
      "summary": null
    }
  ],
  "next_before": null
}

{
  "id": "a93e…",
  "type": "order",                       // booking | reservation | order | appointment | quote | enquiry | …
  "summary": "2 Paneer Tikka (half) and 1 Butter Naan to room 204",
  "customer": { "name": "Priya Sharma", "phone": "+919876543210" },
  "date": null,                          // YYYY-MM-DD, when it is for a day
  "time": null,                          // HH:MM, 24-hour
  "items": [
    { "name": "Paneer Tikka", "quantity": 2, "notes": "half portion" },
    { "name": "Butter Naan", "quantity": 1, "notes": null }
  ],
  "notes": "Less spicy",
  "agent_id": "8c2f…",
  "call_ref": "f7c0…",
  "channel": "phone",
  "direction": "inbound",
  "created_at": "2026-10-26T14:05:12Z"
}

{
  "id": "d1f6…",                 // unique per event: ignore repeats
  "type": "request.created",
  "created_at": "2026-10-26T14:05:12Z",
  "livemode": true,              // false for browser test calls
  "data": { …the request… }
}

// Node / Express
import crypto from "node:crypto";
import express from "express";

const app = express();

app.post("/api/voxa-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-Voxa-Signature") ?? "";
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", process.env.VOXA_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`)
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  const same = !!v1 && v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
  if (!fresh || !same) {
    return res.status(400).send("Bad signature");
  }

  const event = JSON.parse(req.body);
  if (event.type === "request.created") {
    const r = event.data;
    // e.g. create the order or booking in your system
    // if (r.type === "order") createOrder(r) ; if (r.type === "booking") createBookingRequest(r)
  }
  res.sendStatus(200);           // answer 2xx within 10 seconds
});

// Next.js (app router): app/api/voxa-webhook/route.ts
import crypto from "node:crypto";

export async function POST(req: Request) {
  const raw = await req.text();
  const { t, v1 } = Object.fromEntries(
    (req.headers.get("x-voxa-signature") ?? "").split(",").map((p) => p.split("=")),
  );
  const expected = crypto
    .createHmac("sha256", process.env.VOXA_WEBHOOK_SECRET!)
    .update(`${t}.${raw}`)
    .digest("hex");
  if (!v1 || v1.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) {
    return new Response("Bad signature", { status: 400 });
  }
  const event = JSON.parse(raw);
  // …handle event.type / event.data…
  return new Response("ok");
}

<script src="https://voxa.sutrixa.com/widget.js" data-key="vxa_pub_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" async></script>

<script src="https://voxa.sutrixa.com/widget.js" data-key="vxa_pub_…" data-button="false" async></script>
<button onclick="VoxaWidget.open()">Speak to our assistant</button>