Skip to main content
Auth Profiles let you define authentication credentials once and reuse them across Pre-Call, During-Call, and Post-Call API requests. Instead of hardcoding tokens or passwords into every action, create a profile in one place and select it wherever you need it.

​
Overview

  • Centrally managed — update a credential in one profile and every action that references it picks up the change automatically.
  • Secure storage — sensitive fields (tokens, passwords, client secrets, API key values) are encrypted at rest.
  • Four auth types — Bearer Token, API Key, Basic Auth, and OAuth 2.0 (Client Credentials).

​
Authentication Types

​
Bearer Token

Send a static token in the Authorization header of every request. Best for APIs that issue long-lived tokens or personal access tokens (e.g. OpenAI, HubSpot private apps).

​
API Key

Attach one or more key-value pairs to the request via header, query string, or request body. Use this type when your API expects a named key such as x-api-key, api_key, or similar.
You can add multiple key-value pairs in a single profile — useful when an API requires more than one credential header.

​
Basic Auth

Authenticate with a username and password, encoded as a standard HTTP Basic credential. The platform sends Authorization: Basic base64(username:password) with each request.

​
OAuth 2.0 — Client Credentials

For machine-to-machine integrations that use the OAuth 2.0 Client Credentials grant. The platform automatically fetches (and refreshes) an access token before each request.
You do not need to manage token refresh yourself. The platform handles the full token lifecycle — request, cache, and refresh — transparently before your API call executes.

​
Managing Profiles

Open Studio → Manage → Auth Profiles to view, create, edit, search, and delete profiles.

​
Create a Profile

  1. Click New Profile.
  2. Enter a Profile Name (e.g. “Salesforce Production”).
  3. Choose an Authentication Type.
  4. Fill in the required fields for the selected type.
  5. Click Save.

​
Edit a Profile

Click the Edit icon next to any profile to update its name, type, or credentials.

​
Delete a Profile

Click the Delete icon next to any profile. The platform will check whether the profile is currently in use:
  • Not in use — a confirmation dialog appears and you can proceed.
  • In use — a usage summary shows which Pre-Call actions, Post-Call actions, and flow nodes reference the profile. Remove the profile from those locations first, then retry deletion.
Deleting a profile that is in use by active actions will cause those API requests to fail. Always review the usage summary before removing a profile.

​
Using a Profile in Actions

Any API Request configuration — in Pre-Call, During-Call, or Post-Call actions — includes an Auth Profile option:
  1. Toggle Use Auth Profile on.
  2. Select a profile from the dropdown.
  3. The platform injects the appropriate credentials at request time.
When a profile is selected, inline auth fields (token, username/password, etc.) are overridden by the profile’s stored values.

​
Best Practices

  • One profile per external service — name profiles after the service they authenticate against (e.g. “Zendesk API”, “Twilio Prod”).
  • Rotate credentials in one place — when a token or secret expires, update the profile and all referencing actions inherit the new value.
  • Use OAuth 2.0 when available — the automatic token refresh reduces manual maintenance compared to static bearer tokens.
  • Audit usage before deletion — always check the usage summary to avoid breaking live agents.