How to track who is calling my public API?

homegrown · 2025-01-27T19:07:01.084Z

Hi!

I have a public api that i have setup for my payment processor.

(its a long story)

There is a “version-test” and “live” version of the api’s.

For some reason, my version-test is getting called recursively and exceeding my workflow limits. Because of this I have had to un-check make “expose this api as public workflow”

Otherwise it goes haywire and will get called recursively.

I do not have any workflows scheduled. My payment processor SHOULD be the only person who has this api link…

What do you think I should do? Luckily the live version is totally fine…

davidb · 2025-01-27T20:11:12.518Z

Consider whether something within your app’s own logic is mistakenly creating the infinite loop.

Regardless, you could secure the publicly available workflow using some type of authentication–even if only rudimentary.

You could use whatever method your payment processor uses to sign its API calls, although some (e.g., Stripe) can be complex and difficult to implement in Bubble.
You can use Bubble’s api_token parameter with a dedicated API key, although that’s unnecessarily permissive.
You can use an ad hoc unique parameter.

homegrown · 2025-01-27T20:23:13.945Z

Interesting! Thanks I will look more into this with what you provided.