so you want something like a one time use only token, so user can to vapi requests on their end but you control the flow, you own the vapi account but its used on customer side so they can hack around.