like let's say you need to be authenticated through a token to access my app endpoints. is the secret token, my way of giving vapi that auth token? or omething else?