I love the streaming capabilities being now native with Bubble. I think it was important to add this capability.
I have an app that is streaming data from Open Router (does not matter could be any provider).
However I have a security question as I am not a security expert and want to avoid to show my API Keys in the front end to end users.
Will using the streaming functionality in the front end like the below/above, will show my API key to end users? Sorry for the simplicity of the question, but I always put every API call in the backend workflows, and I am scared of this functionality. I could not find an explanation in the documentation.
I donāt think stream call are differents. Normally, the API call will be processed server side so thereās no security problem there. However, why did you select Shared header instead of Authentication: Private key in header?
Thank you Jici for the quick reply! Appreciate your help.
Oh ok, so even if I make any direct API call in my front end, with an API Key in the header, it will be processed by āin the backendā by Bubble and will be not visible to end users? And the streaming functionality should behave the same.
Even if looking for the API call with developers tools in my browser, I wonāt be able to find the Header of the request and the API key?
If that is the case, then Bubble is security is even better than I thought!
For any API call that contain headers or parameters, they are processed server side. If thereās no header and no parameters, Bubble will give you the option to process the API call client side, but you need to enable the checkbox for that.
As for the data itself, like @georgecollier say, a dynamic value (not set as private) is public even if the call itself is processed server side (Bubble will send your request with the ānot privateā value from client to server. This can be found in browser console)
Keep in mind that this doesnāt mean this is not secure. In most case the data sent from client to server belong to the current user (if you have set privacy rules correctly)
This is only true for this case, right? (Front end client side action)
If everything is in a backend workflow, that dynamic value (which needs to be set to public) will be 100% hidden even though itās listed as āpublicā in the API connector.
