WebRTC softphone handshake fails with 403 after migrating Zendesk Voice agents

Trying to make sense of why the WebRTC softphone integration is failing during our migration from Zendesk Voice to Genesys Cloud. In Zendesk, agents just clicked ‘Call’ and it worked via their browser. We are trying to replicate that simple click-to-call experience in Genesys Cloud using the Architect flow and the standard WebRTC softphone settings.

When agents log in and attempt to initiate a call, the browser console shows a WebSocket connection error. The specific issue seems to be during the ICE candidate gathering phase. We are using the default Genesys Cloud softphone configuration, which we assumed would mirror the ease of Zendesk’s native voice app.

WebSocket connection to 'wss://<org>.mypurecloud.com/api/v2/websockets' failed: Error during WebSocket handshake: net::ERR_CONNECTION_CLOSED
Failed to load resource: the server responded with a status of 403 (Forbidden)

The 403 error appears in the network tab when the client tries to register the softphone. We have verified that the agents have the ‘Softphone’ application added to their profiles and the correct permissions for ‘Telephony’ and ‘WebRTC’. Is there a specific CORS or security setting in Genesys Cloud that blocks the WebRTC handshake, unlike the more permissive setup in Zendesk? We are on Genesys Cloud version 23.4.1.