is it for like an auth token if I want vapi to be able to reach/read from my api endpoints?