Proxy server guide
Keep assistant configs and API keys on your backend. Route Web SDK calls through your proxy.
Overview
Proxy server keeps assistant configs and API keys on your backend. Frontend sends custom data, backend maps to Vapi calls.
Flow: Frontend -> Your Proxy -> Vapi API -> Response -> Frontend
Never expose your private API key in the browser. Keep it on your server and read it from environment variables.
For public web clients, consider using JWT authentication to further restrict client capabilities.
Frontend setup
frontend.js
The frontend passes only non-sensitive context (e.g., userId, assistant type). Your backend selects the actual assistant configuration and authenticates to Vapi.
Backend proxy server (example)
cloudflare-worker.js
Extract custom data from the request
Parse and validate the fields your frontend sends (e.g., userId
, assistantType
), plus any other context you need.
Result: Secure calls with configs and secrets hidden on your backend.