Pretty simple - Vapi doesn't seem to send a token with the assistant-request endpoint?

To secure the assistant-request endpoint, create a Custom Credential in the Vapi dashboard and reference its

credentialId

in your server configuration. This ensures Vapi sends an authentication token (e.g., Bearer token) with each assistant-request webhook. Example configuration:

json
{
  "server": {
    "url": "https://your-server.com/webhook",
    "credentialId": "cred_abc123"
  }
}

Make sure your server validates the token in the incoming request headers. For more details, see the [Vapi server authentication documentation](https://docs.vapi.ai/server-url/server-authentication). Source: - [Server authentication](https://docs.vapi.ai/server-url/server-authentication)

Message marked as helpful by @Ben R! 🎉

didn't see the config in phones lol;