Client Token (Scoped Bearer Auth)
A Client Token is a scoped, revocable authentication credential designed for frontend web and mobile applications. It grants permission to invoke specific edge API pipelines while enforcing allowed-origin domains and rate limits, safely abstracting sensitive upstream API secrets.
Technical Architecture & Deep-Dive
When frontends need to access APIs, giving them direct access to master API keys is dangerous. Client Tokens decouple public client access from private backend credentials. A client token (`rc_live_...`) is safe to embed in frontend headers because it is restricted to specific pipelines and configured origins (e.g. `https://mycompany.com`).
If a client token is ever compromised, administrators can revoke or rotate it in one click without invalidating master upstream keys or redeploying backend infrastructure.
Key Architectural Benefits
Implement Client Token (Scoped Bearer Auth) at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Can client tokens be used from native mobile apps?
Yes. Client tokens work seamlessly in mobile HTTP headers (`Authorization: Bearer <token>`) combined with rate-limiting rules.
Related Architecture Concepts
Edge Secret Injection is a security pattern where sensitive upstream API credentials (e.g. Stripe Secret Keys, OpenAI Tokens) are stored in an encrypted vault and injected into HTTP request headers exclusively at the edge runtime, ensuring client browsers and mobile apps never see or store the keys.
Zero-Trust API Architecture is a security model based on the principle of "never trust, always verify." Every API request—whether originating outside the perimeter or between microservices—must be strictly authenticated, authorized, encrypted, and validated before execution.
API Rate Limiting is a traffic control mechanism that caps the number of requests a client, IP address, or API token can execute within a specified time window. Rate limiting prevents server overloading, protects against credential brute-forcing, and shields upstream APIs from exceeding subscription quotas.
Ready-to-Use Edge Recipes
To prevent API keys from leaking through the Bubble.io API Connector, route high-value third-party requests through RealComposer. RealComposer stores credentials encrypted at the edge and filters bloated responses, reducing the payload size that Bubble servers must parse.
To solve bubble io hide api key in plugin, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.