Parameters and authentication
Define what the model must send, how values reach your endpoint, and how to protect it with a key or token.
Parameters
On the tool's page, Parameters lists what the model must supply. Choose Add parameter and fill in:
| Field | Meaning |
|---|---|
| Name | For example order_id. It must match any {order_id} in the URL or body template. |
| Type | string, number, integer or boolean. |
| Description | "What this is, in words the model can act on", for example "The order number the caller read out". |
| Required | If ticked, the call is refused when the model leaves it out. |
Before each request Phynxa checks the model's arguments: required ones must be present, values must match their type (a spoken "twelve" sent as text to an integer is rejected with a message the model can recover from), and anything the model invents that is not defined is dropped.
Body template
For POST, PUT and PATCH, the Body template lets you shape the JSON. Write valid JSON and use {name} placeholders:
{
"orderId": "{order_id}",
"channel": "voice-agent",
"note": "{note}"
}Placeholders are escaped, so a caller cannot break out of a string by saying a quotation mark. If the template is not valid JSON after substitution, the tool reports "Body template is not valid JSON".
Authentication
Under Authentication, choose a Type:
| Type | What Phynxa sends |
|---|---|
| None | Nothing extra. |
| API key | The secret in a header or query parameter you name. Set Sent as to Header or Query parameter and Name to, for example, X-Api-Key. |
| Bearer token | Authorization: Bearer <secret>. |
| OAuth token | Authorization: Bearer <secret> (a token you paste; Phynxa does not run the OAuth flow for tools). |
The page says "The secret is stored on the server and never sent back to this page." To replace it, type a new one. Leaving the field empty keeps the stored one.
Headers
Under Headers, choose Add header to send extra headers with every request, for example Accept-Language: en. A value can contain {parameter} to insert what the agent collected. Headers are not hidden: put keys and tokens under Authentication, which stores them on the server.
Limits
- Timeout: up to 30 seconds, default 5. "The caller waits in silence, so keep this short."
- Attempts: 1 to 5. "Only timeouts and server errors are retried." Requests that change something (POST and PATCH) are never retried, so a booking cannot be made twice.
Testing
Use Test with a real value. See Test and troubleshoot tools.
Related guides
Something here does not match what you see in the dashboard? Let us know.