How does API Connector works on the backend?

[boston85719]

@NigelG

And in this case you are usually given a time limited token, which can be refreshed. If you don’t have the right credentials … you can’t refresh. If the user revokes access - it can’t be refreshed.

So whilst you should be looking after the Token, they are, by design, limited in the damage they can do should they get into the wild.

Therefore, storing it in the database in text is probably no terrible thing. Particularly as you need other credentials as well.

This is the type of Token I am referring to…the Access and Refresh Tokens.

If you are referring to the App Client Keys, Secret Keys etc. then this part is applicable

@NigelG

The issue we have with Bubble is that we also have to store OUR creds in text.

I have asked several times that the “secret” implemented in the Server Side Plugins should be available in the API connector.

The way I have got round this before is to use a third party to hold the tokens (in this case auth0) or use a small webtask to run the call. This means the credentials are not all in Bubble.

In the Bubble API Connector your keys are stored as text I suppose when setting up different APIs using these various Authentication methods

But any of these parameters are not accessible to anybody except those with access to the app editor, as they are not saved as a Data Type entry or anything like that.

Plus any values you put into the API calls that you label as ‘Private’ like below, these are not accessible from the page as far as I know and should be secure. The only way somebody would have access to these would again be if they had access to your app editor.

Bubble treats these types of values very securely in how they treat them as far as I can tell. In fact, if a template is using the API Connector to setup API calls for use in the template, which for obvious reasons necessitate the use of Private keys and App secret keys etc…these are not possible to transfer to the newly created app from the template…Database values however can be.

Also, if the idea were to keep the APP Client and Secret Keys through webtask, I personally I have no experience with what webtask is or what it can do, but working only in Bubble on the API Connector, it is not possible to get the APP Client or Secret Keys to be used dynamically in most Authentication methods available unless you are doing ‘none or self handled’.