Vapi Phone Number Setup

Default to a payload or implementation plan. Provision, import, route, or release a number only when the user explicitly requests the live mutation. Require a final explicit confirmation immediately before provisioning or another potentially chargeable action.

Security and Source Rules

• Never ask for carrier passwords, auth tokens, API keys, API secrets, or private keys in chat.
• Use an existing Vapi credentialId for provider imports when the current public schema supports it. If a required credential does not exist, stop and state that API prerequisite.
• If the public API requires raw carrier secrets and exposes no credential-based alternative, source them from local environment variables without displaying them, writing them to payload files, or logging the request body.
• Verify provider fields against the current Create Phone Number API or public OpenAPI schema.
• Never invent phone numbers, SIP realms, credentials, resource IDs, area-code availability, or routing destinations.

Procedure

1. Determine the execution mode.
   • Return a payload or plan when the user asks for a draft or does not clearly authorize a live mutation.
   • For a live request, confirm that VAPI_API_KEY is set without printing it.