----------------------------- **While I generate an answer, here are some sources that might be helpful**: * [Client SDKs]() * [Web SDK]() * [Pizza Website Example]() * [Vapi Web SDK]() -----------------------------

### Answer Understanding your security concerns, Vapi has implemented measures to mitigate the risks associated with exposing your public key in a client-side environment. To address the specific concern of unauthorized usage of your assistants and incurring unwanted charges, Vapi allows you to: 1. Restrict your public key to your domain. This is done through browser mechanisms that prevent websites from altering their header Origin, ensuring that calls made using your public key can only originate from your specified domain [(1)]() . 2. Restrict your public key to work only with a specific assistantId, disallowing the creation of transient assistants with your public key. This means that only pre-defined assistants that you've created and specified can be used, further controlling the usage of your resources. 3. Use JWT for enhanced security. You can sign a JWT in your backend with your Vapi private key if the user is logged in. This JWT is then passed to the Web SDK, which Vapi's backend verifies to ensure it was signed by the correct key. This method requires you to get in touch with Vapi support to set it up but offers a strong layer of security by tying API actions to verified user sessions. These measures are designed to give you control over how your public key is used, ensuring that your Vapi resources are protected against unauthorized access and usage.