> ## Documentation Index
> Fetch the complete documentation index at: https://corsair-managed-webhooks.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Credentials

> Step-by-step instructions for obtaining Vapi API keys and webhook secrets.

This guide walks you through obtaining all required credentials for the Vapi plugin.

## Authentication Method

The Vapi plugin uses API key authentication.

* **[`api_key`](/concepts/api-key)** (default) - API key authentication

## API Key Setup

### Step 1: Get API Key

1. Log in to your [Vapi dashboard](https://dashboard.vapi.ai)
2. Click on your account name in the top-right corner
3. Go to **Organization** → **API Keys**
4. Click **Create API Key**
5. Give your key a name (e.g., "Corsair Integration")
6. Copy the API key immediately
7. **Important**: Store the key securely — you won't be able to see it again

**Storing Credentials:**

The preferred method is to store the API key in the database using the keys API:

```ts theme={null}
await corsair
    .withTenant('default')
    .vapi.keys.setApiKey('your-api-key');
```

Alternatively, you can provide the key directly in the plugin configuration:

```ts corsair.ts theme={null}
vapi({
    key: process.env.VAPI_API_KEY,
})
```

Or store it with the Corsair CLI:

```bash theme={null}
pnpm corsair setup --plugin=vapi api_key=your-api-key
```

## Webhook Secret

Vapi uses a **shared secret** header (`x-vapi-secret`) rather than an HMAC signature. You choose the secret value and configure it in both your Vapi server URL settings and Corsair.

### Step 1: Configure Webhook URL in Vapi

1. In the [Vapi dashboard](https://dashboard.vapi.ai), go to **Settings** → **Webhooks** (or configure per-assistant via `serverUrl`)
2. Set the **Server URL** to your webhook endpoint (e.g., `https://yourapp.com/api/webhook`)
3. Set the **Server URL Secret** to a strong random string — this is the shared secret Vapi will send as the `x-vapi-secret` header on every request

### Step 2: Store the Secret in Corsair

**Preferred method** — store in the database:

```ts theme={null}
await corsair
    .withTenant('default')
    .vapi.keys.setWebhookSignature('your-webhook-secret');
```

Or pass it directly in the plugin configuration:

```ts corsair.ts theme={null}
vapi({
    webhookSecret: process.env.VAPI_WEBHOOK_SECRET,
})
```

Or use the CLI:

```bash theme={null}
pnpm corsair setup --plugin=vapi webhook_signature=your-webhook-secret
```

## Required Credentials Summary

| Credential     | Required For      | Where to Find                                          |
| -------------- | ----------------- | ------------------------------------------------------ |
| API Key        | API calls         | Dashboard → Organization → API Keys                    |
| Webhook Secret | Incoming webhooks | Your own value — set in Vapi's Server URL Secret field |

For general information about how Corsair handles authentication, see [Authentication](/concepts/auth).