Consumer tokens

Every agent accepts Authorization: Bearer <token>. Tokens are namespaced by a consumer label so you can revoke one without touching the others.

{
  "auth_tokens": {
    "closebot-prod": "ambrose_aBc123…",
    "vapi-test":     "ambrose_xYz456…",
    "webhook-zap":   "ambrose_mNo789…"
  }
}

Generate

Agent detail → Consumer Tokens → type a name → Generate. The token is shown once. Copy it now or rotate.

Revoke

Same panel → Revoke next to the consumer name. The token stops working immediately; other consumers keep going.

Open vs auth

Webhooks (closebot / vapi / retell / custom / ghl) are open by default — external platforms rarely set headers. Use URL secrecy or a signature header for protection. The other endpoints (run, openai, mcp) accept session, agency Bearer, or consumer token.