> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.vapi.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.vapi.ai/_mcp/server.

# Enhanced Authentication & Custom Credentials

1. **Custom Credential System**: You can now create and manage custom authentication credentials using the new [`CustomCredential`](https://api.vapi.ai/api#:~:text=CustomCredential) system. This powerful new feature supports multiple authentication methods:
   * **OAuth2 RFC 6749**: Full OAuth2 implementation for secure third-party integrations
   * **HMAC Signing**: Cryptographic message authentication for enhanced security
   * **Bearer Token**: Simple token-based authentication for API access

2. **Bearer Authentication Plans**: Implement secure token-based authentication with [`BearerAuthenticationPlan`](https://api.vapi.ai/api#:~:text=BearerAuthenticationPlan). Key features include:
   * `token`: Your secure bearer token value
   * `headerName`: Custom header name (defaults to 'Authorization')
   * `bearerPrefixEnabled`: Toggle 'Bearer ' prefix inclusion (defaults to true)

3. **Enhanced Webhook Credentials**: Webhook integrations now support advanced authentication through [`WebhookCredential.authenticationPlan`](https://api.vapi.ai/api#:~:text=WebhookCredential.authenticationPlan), enabling secure webhook communications with OAuth2, HMAC, or Bearer authentication.

4. **Server Authentication**: Secure your server endpoints with credential-based authentication using [`Server.credentialId`](https://api.vapi.ai/api#:~:text=Server.credentialId) to link your custom credentials to webhook destinations.

5. **Tool Authentication Integration**: API request tools can now use custom credentials for secure external API calls via [`ApiRequestTool.credentialId`](https://api.vapi.ai/api#:~:text=ApiRequestTool.credentialId), eliminating the need to embed sensitive authentication details directly in tool configurations.