Adding Dynamic Inputs: Secure, Firm-Defined Fields for Ask Clio API Calls
Dynamic Inputs allow your firm to define arbitrary, secure fields that can be injected into Ask Clio tool calls at runtime.
Dynamic Inputs allow your firm to define arbitrary, secure fields that can be injected into Ask Clio tool calls at runtime.
This works similarly to passing a clearing account ID, but instead of relying on a single pre-defined identifier, Dynamic Inputs let you create any number of firm-defined inputs (e.g. internal account IDs, portfolio IDs, entitlement flags, jurisdiction codes) and pass them securely via the Ask Clio session token API.
Dynamic Inputs are:
Passed server-to-server during session creation
Not exposed to the LLM prompt
Only available to tools that explicitly reference them
How Dynamic Inputs Work
Your firm defines one or more Dynamic Input keys in the Ask Clio dashboard
Your backend passes values for those keys when creating a session token
Ask Clio makes those values available to tools during execution
Step 1
Navigate to Integrations → Dynamic Inputs in the Ask Clio dashboard.
Step 2
Create a new Dynamic Input by defining a key. This key represents a secure identifier that exists in your own system.
Examples:
internal_account_id
portfolio_id
advisor_tier
jurisdiction_code
Note on User Identity
Dynamic Inputs are intended for resource- or account-level identifiers (e.g. internal account IDs, clearing account IDs, portfolio IDs).
Do not use Dynamic Inputs as a replacement for
user.id.user.idshould always represent your application’s internal user identifier (for example, a user UUID from your auth system).
Chat history is not affected by Dynamic Inputs. Conversation history is always keyed by
user.id.
Step 3
Set the Dynamic Input key that you will reference in your API calls.
This key:
Maps to a value stored in your database
Is passed explicitly during session creation
Is never derived or inferred by Ask Clio
Ask Clio does not persist this value outside the session lifecycle.
Step 4
Use your Client Signing Keys to securely pass Dynamic Input values when creating a session token.
Dynamic Inputs are included in the tools_input object of the token request.
Security & Model Access
Dynamic Inputs are never included in the LLM prompt
They are only accessible to tool execution
They are passed server-to-server during session creation
They are only returned in responses if a tool explicitly returns them
This mirrors the security model used for clearing account identifiers.
Example
Description
This endpoint generates a session token for Ask Clio by calling the token API with client-specific information.
In this example, internal_account_id is a firm-defined Dynamic Input passed in the tools_input field, allowing Ask Clio tools to access client-specific data securely.
How It Works
Important: User ID vs Dynamic Inputs
Dynamic Inputs (including clearing account identifiers such as
alpaca_account_id) must be passed only viatools_input.Do not place clearing account IDs in
user.id.The
user.idfield should always represent your application’s internal end-user identifier (e.g. your user UUID), not a brokerage or clearing account.
Token Request (to Ask Clio)
The Endpoint URL is https://app.askclio.ai/api/auth/v1/client-identities/tokens
{
"client_id": "3254c04e-f81f-4794-85ec-7f641ffdd1c0",
"client_secret": "[CLIO_CLIENT_SECRET]",
"user": {
"id": "client-uuid",
"email": "demo@roboadvisor.com"
},
"tools_input": {
"internal_account_id": "DEMO-5555"
}
}
Response
{
"success": true,
"token": "395d9ec11ae980837b284939efd...",
"expires_at": "2026-01-24T16:58:51.331982Z",
"client": {
"id": "11111111-2222-3333-4444-555555555555",
"name": "John Doe",
"email": "demo@roboadvisor.com",
"account_number": "DEMO-5555"
}
}
SDK Usage
Pass the session token to the Ask Clio SDK using the st query parameter:
https://app.askclio.ai/?client_id=CLIENT_ID&st=SESSION_TOKEN
The session token encapsulates all Dynamic Inputs for that user session and is consumed automatically by Ask Clio tools.
Dynamic Inputs vs Clearing Account IDs
Last updated