API connector schema and security

Questions
1

What is the secure way to initialize and clear an API connector call?

Bubble docs say:
image

First part:
What I understand is: everything included in the call during initialization is publicly visible, so initialization should be done with “dummy data”. Does this include parameters marked as private during initialization? What does the API schema include specifically? How can I see it?

Second part:
I came across the term “initialization clearing” which I believe means erasing the parameters values after intialization. If the API schema already contains the parameters values that were set during intialization, what is the use of this clearing? Is it just to not have any value included by default in the calls but not a security measure?

Thanks!

2

We have been doing app audits over the last few months and can confirm on this.

Firstly, Bubble now automatically obfuscates returned values during API initialisation.

Secondly, the parameters that you set in the API connector while initialising are visible to the client only if they are not marked as private. This means that all those values will be visible including your endpoint too

1 Like
3

It’s basically anything that’s not private is public.

This guide will help you:

1 Like
4

Thanks both for the help!

@georgecollier, your tips published in the forum are really valuable, thanks so much for sharing all that knowledge!

1 Like