Hi everyone
I’m currently building an interview platform using Vapi (Next.js frontend + NestJS backend) and had a question regarding transient agents and prompt security for web calls.
My goal is to keep the system prompt secure and not expose it on the frontend. From what I understand:
Using the Web SDK for transient agents requires passing the system prompt client-side (which makes it visible in DevTools)
The /calls API allows passing an inline assistant, which seems like it could be created from the backend
I wanted to clarify:
Is it possible/recommended to create a transient assistant from the backend using the /calls API for web calls?
Can the Web SDK connect to a call/session initiated from the backend?
What’s the best way to avoid exposing system prompts when using transient agents for web-based interactions?
Would really appreciate any guidance or best practices here
Thanks!
cc @User @User