Hi, I'm embedding a Vapi assistant widget in my UI and I'm going to use both mods - chat and voice. In both mods the assistant should use a user-specific Bearer token when calling an API/MCP tool. Providing a static long-living token directly inside dashboard for the tools is not my use case as the tool suppose to return a user-specific data. I tried to use my custom {{userToken}} variable and assistant-override property of the widget to pass this token from UI to Vapi. The assistant seems to catch it as I was able to display it in the chat (I asked to greet a user by name and instead of a name I passed a token). I providing an override property as it's suggested in documentation. <vapi-widget assistant-id={assistantId} public-key={publicKey} mode="chat" title={widgetBtnTitle} accent-color="#2563EB" assistant-overrides={assistantOverrides} > Inside the Dashboard, in the API Request tool I set the Bearer {{userToken}} value for an Authorization request header and added the following system prompt to the Assistant itself: "You must use the {{userToken}} variable as a Bearer token value for Authorization request header when using backend tools and APIs." However when I'm asking an assistant to show me the data I see on my API that it calls a tools literarily with "Bearer {{userToken}}" string and doesn't resolve the variable value. When I'm providing a static access token directly in the dashboard ("Bearer eyh..") the tool works perfectly and the data is returned, so the issue is caused by the variable. What might be an issue? Perhaps I need to somehow explicitly point assistant to use the token in the request header?

The issue is that variables like

{{userToken}}

are not resolved in API tool headers—they are treated as literal strings, not dynamic values. To achieve user-specific Bearer tokens, route API calls through your own backend proxy, which can inject the correct Authorization header per user. For example:

js
// In your proxy, set the Authorization header dynamically
headers: { Authorization: `Bearer ${userToken}` }

This approach keeps tokens secure and enables per-user authentication, as recommended in the [Vapi proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server). Source: - [Proxy server guide](https://docs.vapi.ai/security-and-privacy/proxy-server)

Message marked as helpful by @GIDEON! 🎉

For your authorization request header try inputting bearer {{apiKey}} which is your vapi private api key instead of using {{userToken}}

I understand the issue, your {{userToken}} is being passed as plain text instead of resolving. I can help you set up assistantOverrides so the widget injects the real token into the Authorization header at runtime. Usually this requires mapping the override property directly into the tool config rather than relying only on prompt substitution. Could you share the exact structure of your assistantOverrides object so I can show you the corrected setup? @Alexander