Hey everyone! 👋 I'm working on implementing user-based call duration limits and running into some challenges with the architecture. Here's what I'm trying to achieve: Goal: Allow users to make voice calls for a specific duration (based on their account balance), and automatically terminate calls when their time is up. Current Approach: I'm trying to use the Web SDK with assistant overrides like:

javascript
vapi.start({
  assistantId: "my-assistant-id",
  assistant: {
    maxDurationSeconds: userAllowedTime
  }
});

Issues I'm facing: 1. The

maxDurationSeconds

override feels like it could be manipulated client-side 2. JWT token expiration doesn't seem to terminate active calls mid-conversation 3. I want to ensure calls are properly cut off when time limits are reached Questions: - What's the most secure way to enforce call duration limits per user? - Should I be creating temporary assistants server-side with predefined

maxDurationSeconds

? - Can webhooks help with real-time call termination, or do they only fire after calls end? - Is there a recommended pattern for this type of time-based access control? I'm using the MERN stack on the backend if that matters for webhook implementation. Any guidance on best practices would be hugely appreciated! 🙏

Implement server-side call control by dynamically creating assistants with maxDurationSeconds based on the user’s balance. Use webhooks like call.started and call.ending to track call duration in real time, and enforce hard cutoffs via the Call Control API..

Ok. That sounds good. What's the max number of assistants I can create at a time? Is there any limit on this? And what about the number of concurrent calls ?

Vapi allows unlimited assistant creation, but enforces a default limit of 10 concurrent calls per account so to scale beyond that, you'll have to request a concurrency upgrade..