Yes, i see they already shown a way to do it via API overriding variables, but as you said your client does not have the ability to do that what i suggest is adding the token in the tool secret token. you can "grab" that in the server that receives the request using the X-Vapi-Secret header https://cdn.discordapp.com/attachments/1211484481848873020/1379892270584561664/Screenshot_2025-06-04_at_8.37.34_PM.png?ex=6841e452&is=684092d2&hm=a71e6652bbab58eab4e27ef000a84f2b77a843667dfda6fb665f02808ce18248&