This can't be on purpose, right?

[chris.williamson1996]

Getting a user API token so things are “created by” them

You’ll use the ?api_key param on your call if it’s a get call or Authorization: Bearer (key) for post calls

Build a Rest API

This is absolutely NOT how you want to handle it. To verify an API key is valid with this method you must leave “API key database” public. Which means anyone can access list of keys. You’d also have to verify the user connected to the key which means users would be partly public which can cause DB dumps by bad actors. Rather you need to use bubbles recommended way of doing this. Create a backend workflow called /auth no authentication needed. The only step here is “log the user in”. 2 fields p…