Headers and authentication
API Request tools send a flat headers map with every call. Static headers (API version, content type) are set on the tool; dynamic values can come from parameters. Credentials add auth headers or query params automatically — secrets never appear in tool definitions visible to the model.
Static headers
Section titled “Static headers”Add fixed key/value pairs in the tool editor:
| Header | When to use |
|---|---|
Content-Type: application/json | POST/PUT/PATCH with JSON body |
Accept: application/json | When your API returns JSON |
X-Api-Version: 2024-01 | Vendor-specific versioning |
Dynamic headers
Section titled “Dynamic headers”Mark a header value as a parameter when the model must supply it (rare — prefer path/query/body params for business data). Example: X-Tenant-Id from a multi-tenant context.
Credentials vs manual headers
Section titled “Credentials vs manual headers”| Approach | Use when |
|---|---|
| Credential | Bearer token, API key, OAuth 2.0, HMAC — recommended |
| Static header | Non-secret metadata (version, locale) |
| Manual secret in header | Not supported — use the credentials vault |
Chatevo injects credential values at execution time. Visitors and the LLM never see raw tokens.
Credential types and headers
Section titled “Credential types and headers”| Credential type | How it is applied |
|---|---|
| Bearer | Authorization: Bearer <token> |
| API key (header) | Custom header, e.g. X-Api-Key: <key> |
| OAuth 2.0 | Authorization: Bearer <access_token> (refreshed automatically) |
| HMAC | Signature headers per your signing scheme |
API keys can also be sent as query parameters when configured on the credential.
Example
Section titled “Example”| Setting | Value |
|---|---|
| URL | GET https://api.example.com/products |
| Static headers | Accept: application/json |
| Credential | Bearer token named Production API |