# FYI about encoding base64 private files **URL:** \ **Category:** Tips\ **Created:** [October 14, 2024, 5:40pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243 "2024-10-14T17:40:29Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [October 14, 2024, 5:40pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/1 "2024-10-14T17:40:29Z")
Hey all, I faced a problem over the weekend trying to encode a private file in base64 format. I learned from @draked123 and Bubble Support that this just isn’t possible. Quote Bubble support: > To encode a private file in base64 without access issues, you should be aware that private files in base64 cannot be decoded through API workflows and the API Connector, as these functions rely on the file to be publicly downloadable. Therefore, you cannot use the ‘:encoded in base64’ operator for private files within API workflows or the API Connector because they require the file to be public. > > However, if you need to send a private file via the Bubble API, you can send the file as a base64-encoded string within a JSON object. The JSON object should include the filename and the base64-encoded binary data of the file. If you want the file to be private, you should also include a ‘private’ boolean set to true and an ‘attach\_to’ field with the unique ID of the database object the file should be attached to. **So if you’re facing this same problem, the workaround is to first save your file publicly, encode it, delete it, and then upload the file as private after.** Hope this helps someone else facing the same issue 😊 ---
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [October 14, 2024, 5:56pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/2 "2024-10-14T17:56:03Z")
There’s another approach that might be useful too: ![CleanShot 2024-10-14 at 18.54.09@2x](https://us1.discourse-cdn.com/bubble/original/3X/9/4/9456669477239d15e94209b00d256c8be87f1703.png) :saved to Bubble storage will save the same file without privacy rules ![CleanShot 2024-10-14 at 18.54.36@2x](https://us1.discourse-cdn.com/bubble/original/3X/c/3/c33af2cf7addcfb1982d011e301dbc2afb2ce10a.png) Then encode it ![CleanShot 2024-10-14 at 18.54.50@2x](https://us1.discourse-cdn.com/bubble/original/3X/8/d/8dd70c7eaf0772d24203bfa8d209a0bdac4fa38a.png) And delete the duplicated file. Set that all up in a backend workflow and you can use it anywhere in the app, private/public, frontend/backend, to encode any file in base64. Demo: [https://nquforumdemo.bubbleapps.io/version-test/base64](https://nquforumdemo.bubbleapps.io/version-test/base64) Username: nqu Password: forumdemo As another note, you can pass any private file URL with `?api_token={BUBBLEAPP_APITOKEN}` and it’ll bypass privacy rules on that file URL. Useful for passing private files to APIs. ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [October 14, 2024, 5:58pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/3 "2024-10-14T17:58:04Z")
Hmm, but whenever I pass a private file into a backend workflow and try to `:save to Bubble Storage` to returns an error saying “Unauthorized.” Even running as admin or ignoring privacy rules ---
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [October 14, 2024, 6:02pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/4 "2024-10-14T18:02:28Z")
Here’s a walkthrough of this method: ---
**Author:** ![johnny](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/johnny/32/203020_2.png) [@johnny](https://forum.bubble.io/u/johnny)\ **Post date:** [October 14, 2024, 9:49pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/5 "2024-10-14T21:49:19Z")
Hmm so weird! I’ll have to try this! What I did in my app was pass the private file into the parameter, saved Bubble Storage:encode in base64 and in the logs it said unauthorized and errored ---
**Author:** ![manipaje](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@manipaje](https://forum.bubble.io/u/manipaje)\ **Post date:** [December 19, 2024, 12:06pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/6 "2024-12-19T12:06:14Z")
I’m hitting this issue too and wanted to share / sense check my workaround: Create two internal APIs and one Backend Workflow: API 1: ‘Get image’ ![Screenshot 2024-12-19 at 11.55.58](https://us1.discourse-cdn.com/bubble/original/3X/c/c/cc127c75880e3851fdf4f145d6f321ebf87bd555.png) This is so simple - just turns any Bubble URL into a ‘file’ (‘Send file’ as form data didn’t work). API 2: ‘Base64 image’ ![Screenshot 2024-12-19 at 11.56.12](https://us1.discourse-cdn.com/bubble/original/3X/b/d/bd53285e3f79a7dffa6a8a694830a59b37045af3.png) This uses an API auth token (for security) and then submits an ‘image’ key with the URL of the file you want to convert into base64. File can be private, or not, it’s server side and tests seemed positive for either. Backend Workflow ![Screenshot 2024-12-19 at 11.58.16](https://us1.discourse-cdn.com/bubble/original/3X/a/1/a1706308e7036fb5dcca022b29230172fc2d52d9.png) Just one key - image - which is used to call API 1 ![Screenshot 2024-12-19 at 11.58.29](https://us1.discourse-cdn.com/bubble/original/3X/9/a/9a1f2e9adf7d32a8da022757806c19fab838696a.png) Calling API 1 with our image URL ![Screenshot 2024-12-19 at 11.58.36](https://us1.discourse-cdn.com/bubble/original/3X/b/b/bbcebe9f8246d7b851861063aaba5fd6a9d64d3c.png) Returning our file (from API 1) with the base64 data So we call API 2 with our Image URL, which calls API 1 to return the file which is used in the BE Workflow to get the Base64 as a JSON returned API data. It’s janky, for sure, but it does seem to work and doesn’t require duplicating & deleting files. Which may be better? I’m learning & testing. ---
**Author:** ![randomanon](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@randomanon](https://forum.bubble.io/u/randomanon)\ **Post date:** [December 19, 2024, 12:25pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/7 "2024-12-19T12:25:40Z")
> [@georgecollier](#): > > As another note, you can pass any private file URL with `?api_token={BUBBLEAPP_APITOKEN}` and it’ll bypass privacy rules on that file URL. Useful for passing private files to APIs. Probably a more secure way to do this is to use or create a plugin to get the CDN link in a backend workflow by passing the api token and then just sending over the CDN link, no? I thought there was a plugin that could do that but now I can’t find it. Edit: Found it [File Sharer Plugin | Bubble](https://bubble.io/plugin/file-sharer-1700959315598x627729431336058900) ---
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [December 19, 2024, 12:58pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/8 "2024-12-19T12:58:42Z")
Sure - I’m generally just passing to APIs that I own so it’s not critical to avoid the admin token being sent. If using an external API, it’s wise to avoid sending an admin token if at all possible… ---
**Author:** ![randomanon](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@randomanon](https://forum.bubble.io/u/randomanon)\ **Post date:** [December 19, 2024, 1:25pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/9 "2024-12-19T13:25:13Z")
> [@georgecollier](#): > > I’m generally just passing to APIs that I own Except for NQU “secure” ---
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [December 19, 2024, 1:26pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/10 "2024-12-19T13:26:32Z")
Huh? Nobody has to send us an admin token, ever. Any data we reference is already public… if you don’t like it, don’t use it! ---
**Author:** ![randomanon](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@randomanon](https://forum.bubble.io/u/randomanon)\ **Post date:** [December 19, 2024, 1:27pm UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/11 "2024-12-19T13:27:34Z")
> [@georgecollier](#): > > Any data we reference is already public… Not how copyright works > [@georgecollier](#): > > if you don’t like it, don’t use it! Would be nice if this was a real choice ---
**Author:** ![mattblake](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/mattblake/32/149474_2.png) [@mattblake](https://forum.bubble.io/u/mattblake)\ **Post date:** [June 9, 2025, 1:17am UTC](https://forum.bubble.io/t/fyi-about-encoding-base64-private-files/344243/12 "2025-06-09T01:17:08Z")
Another way is to use the Better Uploader plugin as this plugin will expose a file as base64 without even needing to upload it. My recorded this example showing how to send a base64 image to OpenAI Responses: [Sending base64 image to OpenAI Responses for AI Image Analyse](https://forum.bubble.io/t/sending-base64-image-to-openai-responses-for-ai-image-analyse/372276)