How can I provably confirm that a call hitting my backend was sent by Bubble’s API Connector?

Need help APIs
1

Hi Bubblers

The backend on my currently company, only trusts requests solely based on the trusted origin specified in the URL, but when the call originates from Bubble, adding my site’s domain to the whitelist isn’t enough because the request is actually dispatched by Bubble’s own servers and arrives with a hidden origin header. I need to determine that real, consistent origin—whether it’s a specific IP range, domain, or other identifier used by Bubble’s servers—so the backend can validate and accept only legitimate API Connector requests while blocking any replay attempts from tools like Postman.

2

Why not just use tokens passed with the payload through the API Connector? Store it in Bubble’s backend. Grab it when passing the token and payload as a server side action.

Verify that the token matches as part of your Bubble endpoint workflow.

1 Like