Hi, I'm using the new integration of the OAuth 2.0 credentials. It seemed to work fine in the beggining but now I don't think the refresh token flow is being properly handled as I'm getting expired tokens on my webhooks/tools endpoints. Can you shime some light on this issue? Are new tokens generated per request? Are the tokens only generated once per integration? If so, how do you handle the expired ones? Also, I used to use custom headers to place my Auhtorization header but since adding this integration I can't properly delete them. I delete them, save the webhook/tool and after the refresh there they are again with the same values.. Thanks!

Hi Pedro Afonso, For setting up OAuth2 authentication for custom LLM models and webhooks, you'll use the

CreateCustomLLMCredentialDTO

or

CreateWebhookCredentialDTO

payload. Here’s a brief example for creating a custom LLM credential:

json
{
  "provider": "custom-llm",
  "apiKey": "your-api-key",
  "authenticationPlan": {
    "type": "oauth2",
    "url": "https://your-url.com/your/path/token",
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret"
  },
  "name": "your-credential-name"
}

Similarly, for webhooks, you can use:

json
{
  "provider": "webhook",
  "authenticationPlan": {
    "type": "oauth2",
    "url": "https://your-url.com/your/path/token",
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret"
  },
  "name": "your-webhook-name"
}

You can find detailed guidance on creating custom credentials in the changelog links for [December 6, 2024](https://docs.vapi.ai/changelog/2024/12/6) and [August 30, 2025](https://docs.vapi.ai/changelog/2025/8/30).

I think we're talking about different features, I'm talking about this authentication configuration for tool and message calls: - How does it handle expired tokens? Can it request a new token via the refresh flow? Does it create a new token? - Why can't I delete the previous custom authorization header that I mentioned above? Thanks https://cdn.discordapp.com/attachments/1425414448218243177/1425796227659858000/image.png?ex=68e8e3b6&is=68e79236&hm=51aecd39712c473d376354d70d3a1af3a98665232cfd538a3a00b51646758112&

Here's how authentication and token handling works: 1. Custom Credentials System supports: - OAuth2 RFC 6749 (full implementation) - HMAC Signing - Bearer Token authentication 2. Bearer Authentication Plans can be configured with:

{  "token": "your-secure-token",  "headerName": "Authorization",  // customizable  "bearerPrefixEnabled": true    // optional, defaults to true}

3. For tool authentication: - Use

ApiRequestTool.credentialId

to link custom credentials - Avoids embedding sensitive auth details in tool configs 4. For webhook credentials: - Configure via

WebhookCredential.authenticationPlan

- Supports OAuth2, HMAC, or Bearer authentication However, the documentation doesn't specifically address: - Token refresh flows - Expired token handling - Deletion of custom authorization headers