assistantId or a minimal assistant, then enrich context asynchronously after the call starts using Live Call Control.
+ - Host your webhook close to us-west-2 to reduce latency, and target < ~6s to allow for network jitter.
+assistantId, assistant, squadId, and squad are ignored.
+ You must still respond within 7.5 seconds.
+ To transfer silently, set destination.message to an empty string.
+ For caller ID behavior, see Call features.
+ 
+
+
+You can create different types of authentication credentials:
+
+- **Bearer Token**: Simple token-based authentication
+- **OAuth 2.0**: OAuth 2.0 client credentials flow
+- **HMAC**: HMAC signature-based authentication
+
+## Authentication Types
+
+### Bearer Token Authentication
+
+The most common authentication method using a bearer token in the Authorization header.
+
+
+
+
+#### Standard Authorization Header
+
+The most common Bearer Token configuration uses the standard `Authorization` header with the Bearer prefix:
+
+
+
+
+### OAuth 2.0 Authentication
+
+For OAuth 2.0 protected endpoints, configure client credentials flow with automatic token refresh.
+
+
+
+
+#### OAuth 2.0 Flow
+
+1. Vapi makes a token request to your OAuth endpoint with client credentials
+2. Your server validates the credentials and returns an access token
+3. Vapi includes the access token in the Authorization header for webhook requests
+4. When tokens expire, Vapi automatically requests new ones
-The simplest way to authenticate webhook requests is using a secret token. Vapi will include this token in the `X-Vapi-Signature` header of each request.
+#### Token Response Format
-#### Configuration
+Your OAuth server should return:
```json
+{
+ "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+ "token_type": "Bearer",
+ "expires_in": 3600
+}
+```
+
+### HMAC Authentication
+
+For maximum security, use HMAC signature-based authentication to verify request integrity.
+
+
+
+
+## Using Credentials
+
+### In Assistant Configuration
+
+Reference credentials in your assistant's server configuration:
+
+
+
+
+### In Phone Number Configuration
+
+Assign credentials to phone numbers for incoming call authentication:
+
+
+
-For OAuth2-protected webhook endpoints, you can configure OAuth2 credentials that Vapi will use to obtain and refresh access tokens.
+### In Tool Configuration
-#### Configuration (at the assistant-level)
+Secure your function tool endpoints with credentials:
-```json
+
+
+
+### Best Practices
+
+
-
+## Common Use Cases
-#### OAuth2 Flow
+### Single Credential for Multiple Resources
-1. Vapi makes a request to your token endpoint with client credentials (Content-Type `application/x-www-form-urlencoded`)
-2. Your server validates the credentials and returns an access token
-3. Vapi includes the access token in the Authorization header for webhook requests
-4. Your server validates the access token before processing the webhook
-5. When the token expires, Vapi automatically requests a new one
+Reuse the same credential across different components:
+
+
+
+ 
+
+
+ Your credential is now ready to use with encrypted tool arguments.
+ 
+
+
+
+ 
+
+ 
+