Hello. I am looking for a golden path to achieve security with private data. For simplicity, lets say I'm hooking up an assistant to a vector db with external tool calls. I want users to be able to interact with the system through a client. The efficient way to do this seems to be to use the web sdk in the client. The problem is that this exposes the public key. Even if proper auth is set up to access the client, if an employee using the client wrote down the key and left the company, they could access the private data through the assistant from anywhere, right? Is there a way this is addressed. I don't see a great way to pipe the call data through the server where I could hide the public key, which would add latency anyway. OpenAI realtime handles this by creating [ephemeral keys](https://platform.openai.com/docs/guides/realtime-webrtc). If I could use the VAPI api to create public keys I could reproduce that, but I don't see that exposed in the docs. I'm sure others have dealt with this before, open to all advice. Thanks!