2. API Call Example for Creating a Call

const createCall = async () => {
  const response = await fetch('https://api.vapi.ai/call', {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer YOUR_VAPI_API_KEY',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      type: 'webCall',
      assistantId: 'your-assistant-id',
      assistantOverrides: {
        server: {
          url: "https://your-mcp-server.com/mcp-endpoint",
          headers: {
            "X-User-ID": userId,
            "X-Session-Token": userOAuthToken
          }
        },
        // Configure OAuth2 credential for MCP server
        credentials: [{
          provider: "webhook",
          authenticationPlan: {
            type: "oauth2",
            url: "https://your-mcp-server.com/oauth/token",
            clientId: process.env.MCP_CLIENT_ID,
            clientSecret: process.env.MCP_CLIENT_SECRET,
            scope: "mcp:tools:execute user:identify",
            // Additional parameters for user context
            additionalBodyParameters: {
              user_id: userId,
              session_token: userOAuthToken
            }
          },
          name: "mcp-user-credential"
        }],
        // Pass user context via variable values
        variableValues: {
          userId: userId,
          userToken: userOAuthToken,
          orgId: userOrgId
        }
      }
    })
  });

  return response.json();
};

Your MCP server should be configured to handle OAuth2 authentication and user identification:

// MCP Server (Node.js/Express example)
app.post('/oauth/token', (req, res) => {
  const { client_id, client_secret, user_id, session_token } = req.body;
  
  // Validate client credentials
  if (client_id !== process.env.EXPECTED_CLIENT_ID || 
      client_secret !== process.env.EXPECTED_CLIENT_SECRET) {
    return res.status(401).json({ error: 'Invalid client credentials' });
  }

  // Validate user session token
  const userContext = validateUserSession(session_token, user_id);
  if (!userContext) {
    return res.status(401).json({ error: 'Invalid user session' });
  }

  // Generate access token with user context
  const accessToken = jwt.sign({
    client_id,
    user_id,
    org_id: userContext.orgId,
    permissions: userContext.permissions
  }, process.env.JWT_SECRET, { expiresIn: '1h' });

  res.json({
    access_token: accessToken,
    token_type: 'Bearer',
    expires_in: 3600
  });
});

// MCP tool endpoint with user access control
app.post('/mcp-endpoint', authenticateToken, (req, res) => {
  const { user_id, org_id, permissions } = req.user; // From JWT token
  
  // Apply row-level security based on user context
  const toolCall = req.body;
  
  // Example: Filter data based on user's organization
  if (toolCall.function.name === 'get_user_data') {
    const userData = getUserData({
      userId: user_id,
      orgId: org_id,
      permissions: permissions
    });
    
    res.json({
      result: userData,
      user_context: {
        user_id,
        org_id
      }
    });
  }
});

function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.sendStatus(401);
  }

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

Key Points: 1. **OAuth2 Flow**: Use webhookCredential with oauth2 type for proper authentication flow 2. **User Context**: Pass user identifiers through headers, body parameters, or variable values 3. **Row-Level Security**: Implement access control in your MCP server based on the authenticated user 4. **Token Validation**: Always validate tokens and user permissions on your MCP server 5. **Dynamic Headers**: Use variable substitution for dynamic user-specific values This setup ensures that every tool call to your MCP server includes the necessary user context for proper identification and access control.