Tool argument encryption

Create a custom credential with encryption

1. Open the Vapi Dashboard, select Integrations, then select Server Configuration.
2. Select Add Custom Credential. Choose the Authentication Type your server uses and complete its required fields.
3. Select Enable Encryption and confirm RSA-OAEP-256 for Encryption Algorithm and SPKI-PEM for Public Key Format.

Generate RSA key pair

Use OpenSSL to generate a public/private key pair in PEM format.

Run this command in your terminal to generate both keys:

# Generate a 2048-bit RSA private key
openssl genrsa -out private-key.pem 2048
# Extract the public key in SPKI format
openssl rsa -in private-key.pem -pubout -out public-key.pem

This creates two files:

• private-key.pem - Keep this secure on your server for decryption
• public-key.pem - Copy this to Vapi for encryption

Add public key to credential

Copy and paste your public key into the Dashboard.

1. Open public-key.pem and copy the entire contents.
2. Paste the public key into Public Key PEM.
3. Select Save.

Your credential is now ready to use with encrypted tool arguments.

Select a tool to configure

1. Select Tools in the Dashboard.
2. Open an existing Function tool or API Request tool, or create a new tool.

Configure credential and encryption settings

Link your encryption credential and specify which fields to encrypt.

1. Expand Authorization and select the credential you created from Credential.
2. Expand Encryption Settings and select Add Path for each request body field you want encrypted.
3. Enter each field’s exact path under Encrypted Paths.

Example JSON paths:

• ssn - Encrypts the ssn field
• payment.cardNumber - Encrypts nested fields

Publish and test the configuration

Publish your tool configuration and verify encryption works with a test call.

1. Select Publish to apply the tool draft.
2. Make a test call using an assistant with this tool.
3. Trigger the tool during the call.
4. Check your server logs to confirm encrypted data arrives.

When your server receives the webhook, encrypted fields will appear as base64-encoded strings:

{
    "fullName": "John Doe",
    "dateOfBirth": "ZCT0EvFkJRHShBd06Ldu7ImHgl7YCuX8l8IF/7xuQSydafVWRR2eCGqTeXK7HyMaXyDc3hHyaTwTKyd0kJH0TCgQEJwviTLSlt7IzH4BIVXIadYcmCUbcSN77R6HoYtGE/De8hEYZ0t+bfuKnDY1IyiQXViI1oE+A2hiscrl4x9Or+n3CUSvxXQ3fJREsCHVN4Y4jbLtQOh0bhlsKLol7GEXBGnOG+oBlXvIzEgyco/peusg7Vzeq42F9odQyZZop9u8+ynwz3DOCm9JBZdOuf7iCKKos0NU+VeWanUHvJ2aJfGPck7qleFWDFsCb+F6QcIcn3fkiKTqoYa44vQ+NA=="
}

Decrypt data on your server

Use your private key to decrypt the base64-encoded encrypted values.

Here’s how to decrypt the data in your server code:

import crypto from 'crypto';
import fs from 'fs';
function decryptToolArgument(encryptedBase64: string): string {
  // Load your private key
  const privateKey = fs.readFileSync('private-key.pem', 'utf8');
  
  // Decode from base64
  const encryptedBuffer = Buffer.from(encryptedBase64, 'base64');
  
  // Decrypt using RSA-OAEP with SHA-256
  const decrypted = crypto.privateDecrypt(
    {
      key: privateKey,
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256',
    },
    encryptedBuffer
  );
  
  return decrypted.toString('utf8');
}
// Example usage
const encryptedDateOfBirth = "ZW5jcnlwdGVkX2RhdGFfaGVyZQ==...";
const decryptedDateOfBirth = decryptToolArgument(encryptedDateOfBirth);
console.log(decryptedDateOfBirth); // Original value