ElevenLabs is powerful for voice AI, but its secrets are workspace-scoped, not per-user. Building a multi-tenant agent platform means building your own credential vault. Here is the architecture that works.
The platform coordinates speech-to-text, an LLM orchestrator, text-to-speech, and a tools system, deployable to web, mobile, telephony, and WhatsApp. But there is no native distinction between one user's Slack token and another's, so per-user OAuth needs your own encrypted token store, refresh handling, and injection via secret-prefixed dynamic variables.
The recommended pattern: one shared workspace, per-user tokens injected at conversation start, and the secret__ prefix so credentials never reach the LLM. It is the same lesson XO environments encode: secrets belong to the workspace layer, not the model.
Workspace-scoped secrets
The Secrets API handles app-level keys. Per-user tokens are yours to store and refresh.
The secret__ prefix
Dynamic variables injected into tool headers, never exposed to the LLM.
Three tenancy options
Shared workspace with injected tokens, per-user workspaces, or a hybrid by organization.