# Using bubble for API authentication at the backend

**URL:** <https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330>\
**Category:** APIs\
**Created:** [November 30, 2021, 12:44am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330 "2021-11-30T00:44:39Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [November 30, 2021, 12:44am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/1 "2021-11-30T00:44:39Z")

</div>

Hello Everyone,

We are building an app whose frontend is built in Bubble. Currently, a logged-in user (who signs up through bubble’s sign up flow) views certain data that is being pulled via an API. This API can also be used by the users directly.

I was wondering is there a way to do the following:

1. Call bubble login workflow to get the auth token
2. Call the API with the obtained auth token
3. The API calls Bubble to validate the token and return the result

I am aware that this can be done if we use AWS Cognito or anyAuth0. However, in that case, the login and signup should also be done using them, increasing the complexity.

Any guidance around this would be quite helpful.

---

<div class="post-metadata">

**Author:** ![ankur1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@ankur1](https://forum.bubble.io/u/ankur1)\
**Post date:** [November 30, 2021, 2:24am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/2 "2021-11-30T02:24:06Z")

</div>

You can use the Bubble Data API along with API key authentication.

---

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [November 30, 2021, 2:39pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/3 "2021-11-30T14:39:59Z")

</div>

@ankur1 Thanks for the response. The data that I am pulling is coming from an external API, so it is not being stored in bubble’s database.

---

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [November 30, 2021, 3:07pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/5 "2021-11-30T15:07:26Z")

</div>

@Sarah_Biberei Thanks for the response, I will go over the video asap.  
Let me try to elaborate on my use case a bit more. So my frontend in Bubble calls an API in the backend (AWS API Gateway) and directly shows the data in a table. Right now, I am calling the API directly without any token. What I was wondering was, what would be an effective way at the API end to make sure:

1. If the call comes from a logged-in user in Bubble, return the data.
2. If the call is from an external source(like Postman), authenticate using a token that is generated when the login WF of Bubble is called.

Basically, I am trying to use Bubble inbuilt authorization to authenticate users to use backend APIs. I hope it makes the use case a little more clearer

---

<div class="post-metadata">

**Author:** ![ryanck](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@ryanck](https://forum.bubble.io/u/ryanck)\
**Post date:** [November 30, 2021, 3:20pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/6 "2021-11-30T15:20:15Z")

</div>

Nice tutorial!

What if the user has a company and you want to create the API Key to access the information about the company? How could you do that?

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![Sarah\_Biberei](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sarah_biberei/32/106203_2.png) [@Sarah\_Biberei](https://forum.bubble.io/u/Sarah_Biberei)\
**Post date:** [November 30, 2021, 3:29pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/7 "2021-11-30T15:29:33Z")

</div>

Hey,

just to get it right. You use the bearer token from the user, this has nothing to do with the company where he might allocate to.  
As long as your data privacy rules allow that this specific user can see this specific information about a company, you are good to go.

Many greetings.

Sarah

---

<div class="post-metadata">

**Author:** ![Sarah\_Biberei](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sarah_biberei/32/106203_2.png) [@Sarah\_Biberei](https://forum.bubble.io/u/Sarah_Biberei)\
**Post date:** [November 30, 2021, 3:38pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/8 "2021-11-30T15:38:04Z")

</div>

Hey @ratebunni

Thanks for the clarification. This case is quite the opposite of what I describe in my tutorial.  
We had a quick look at the AWS documentation and found this one which might help you [Use AWS Lambda authorizers with a third-party identity provider to secure Amazon API Gateway REST APIs | AWS Security Blog](https://aws.amazon.com/de/blogs/security/use-aws-lambda-authorizers-with-a-third-party-identity-provider-to-secure-amazon-api-gateway-rest-apis/)

The third party identity provider in this case would bubble.

This being said, we have never done it this way, but we would start with this documentation. So you would basically set up a lambda authorizer function. That function would take the bubble (identity provider) token that is sent with the bubble request and validated with bubble as a third-party identity provider.

If you need help with that, please DM me, maybe we can set something up.

Hope that helps.

Many greetings.

Sarah

---

<div class="post-metadata">

**Author:** ![simon7](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/simon7/32/46991_2.png) [@simon7](https://forum.bubble.io/u/simon7)\
**Post date:** [November 30, 2021, 4:35pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/9 "2021-11-30T16:35:00Z")

</div>

I can elaborate on a solution I use later tonight, but just wanted to hear if you are using api gateway v1 (rest) or v2 (https) api?

---

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [November 30, 2021, 4:57pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/10 "2021-11-30T16:57:57Z")

</div>

@simon7 I am using v1 (REST) and am looking forward to your solution

---

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [November 30, 2021, 4:59pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/11 "2021-11-30T16:59:17Z")

</div>

Thanks again @Sarah_Biberei. From a high level your solution makes sense, I am going to go through the link and will update if this approach works.

---

<div class="post-metadata">

**Author:** ![simon7](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/simon7/32/46991_2.png) [@simon7](https://forum.bubble.io/u/simon7)\
**Post date:** [November 30, 2021, 7:05pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/12 "2021-11-30T19:05:07Z")

</div>

@ratebunni  
Ok, so short description: Upon login I run a workflow against a lambda on AWS - basically a post request to an /auth endpoint that returns a jwt-token with a 1h expiration. This is done server side with a client\_credentials oauth2 workflow. In my case I don’t send the users login information - those has already been verified by bubble, so I don’t need them). The returned jwt is saved on the user together with the expiration (remember privacy settings so only current user can see it). The token can now be reused by any workflow to my other lambdas. I have another workflow that checks the expiration. It is run at login, page-changes AND every 5min. If there is \<10 min to expiration, I create a new token.

In my case I use http api which have built in jwt authorizer, but for your case you could make a lambda authorizer instead and simple verify the jwt here. Remember to use caching so that your authorizer don’t need to run at every request.

Details:  
The /auth endpoint can include data about the user (email, id etc.) which you can save in the jwt. When your authorizer reads the jwt in can pass along the data to any lambda that comes after via a context field, which means you don’t have to parse the jwt in each lambda - its done once in the authorizer and passed on to every lambda after.

It certainly is an advanced method, but its very reliable once setup!

---

<div class="post-metadata">

**Author:** ![ratebunni](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@ratebunni](https://forum.bubble.io/u/ratebunni)\
**Post date:** [December 3, 2021, 12:18am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/13 "2021-12-03T00:18:14Z")

</div>

@simon7 I got the crux, I am going to try the same with Cognito, so this approach seems that it will take care of my needs. Thanks

---

<div class="post-metadata">

**Author:** ![simon7](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/simon7/32/46991_2.png) [@simon7](https://forum.bubble.io/u/simon7)\
**Post date:** [December 3, 2021, 7:21am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/14 "2021-12-03T07:21:21Z")

</div>

Great, it should be doable. The only downside I see is that you are gonna be handling users at two different places, bubble and cognito - that might become a headache

---

<div class="post-metadata">

**Author:** ![rico.trevisan](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/rico.trevisan/32/170176_2.png) [@rico.trevisan](https://forum.bubble.io/u/rico.trevisan)\
**Post date:** [December 3, 2021, 7:43am UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/15 "2021-12-03T07:43:25Z")

</div>

@Kayami put together a brilliant little video on this:

Is this what you’re looking for?

---

<div class="post-metadata">

**Author:** ![stephen.suico](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@stephen.suico](https://forum.bubble.io/u/stephen.suico)\
**Post date:** [January 3, 2022, 11:56pm UTC](https://forum.bubble.io/t/using-bubble-for-api-authentication-at-the-backend/180330/17 "2022-01-03T23:56:04Z")

</div>

Thank you for posting this! Was looking for this answer for more than 6 months now!  
Can you do a quick run through on the Return Data API part? I want to understand what was going on there 🙂