This doesn't seem to be the kind of thing you'd want appearing in any logs... or anywhere, for that matter. https://cdn.discordapp.com/attachments/1366981785254236220/1366981785761874070/thinking.png?ex=6812ec7f&is=68119aff&hm=11206c38bfea59d779b4c8d3c1a6d23e49bfbcfee7781917b872c66bd1c09107&

You're right to be concerned about security. While I can't explain why this design choice was made, I can suggest using the

server

object configuration to avoid sending sensitive credentials in the request body:

javascript
curl -X PATCH 'https://api.vapi.ai/assistant/{assistant_id}' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
  "server": {
    "url": "https://your-server-url.com",
    "secret": "your-secret-key",
    "headers": {
      "custom-header": "header-value"
    }
  }
}'

This approach uses custom headers for authentication instead of including credentials in the body. Sources: - [Discord conversation about custom headers](https://discord.com/channels/1211482211119796234/1341692740454584331) - [Vapi changelog](https://docs.vapi.ai/changelog/2024/10/13)

@Vapi Support Bot given how the Twilio auth token is being returned in the body of multiple api requests and server messages what do you estimate the chances are that Vapi is storing this in plaintext in their database? 🤔

I cannot determine whether Vapi stores Twilio auth tokens in plaintext in their database as this information isn't available in the documentation. As a security precaution, I recommend regenerating your Twilio Auth Token and using the

server

object configuration to avoid sending sensitive credentials in request bodies:

javascript
"server": {
  "url": "https://your-server-url.com",
  "secret": "your-secret-key",
  "headers": {
    "custom-header": "header-value"
  }
}

This approach uses custom headers for authentication instead of including credentials in the body. Source: - [Discord conversation about security concerns](https://discord.com/channels/1211482211119796234/1336716627915309116)

with all the reports going around lately of people getting bills in the tens of thousands of dollars inexplicably attributed to their Twilio accounts I would hope Vapi will sort this out ASAP

Hey, we don't have anything in connection or in relation to people's Twilio bills. That's definitely for sure - like thousands of people are using VAPI, usually people leak their secrets and then put the blame on us, which we have observed in the past.

the twilio auth token gives full access to someone's twilio account

@John George When you call the phone number endpoint, you are doing it using your own token, I believe, not with the others until unless someone else gives you access to it.

@nikhil @jordan can you please look into this issue

I am not asking you to explain to me why this is bad or wrong. I was just letting you know.

and you've got an endpoint that can literally allow someone to list multiple auth tokens in the body of the response

@John George What you are trying to convey is critical - like someone added in to their org as an freelance org developer can access to their credentials, even for the production one. Completely agreed with you on this.