Appsmith Safe & Unsafe Practices

Direct Answer

Appsmith datasources keep credentials on the Appsmith server, while JS objects and widget bindings run in the browser. Configure secrets in datasources, never in JS code, and use least-privilege accounts for each connected database or API.

Credentials & Where They Belong

Server only

Datasource credentials

Stored and used on the Appsmith server.

Client safe

Values in JS objects

Visible to app users in the browser.

Safe Practices

Configure authentication on datasources
Headers and tokens set on the datasource never reach the client.
Use prepared statements
Keep prepared statements enabled for SQL queries that bind widget values.

Unsafe Practices

Storing API keys in JS objects or app constants
Users can read them in DevTools.
Disabling prepared statements
Widget input can then inject SQL.

The RealComposer Pattern

Register a RealComposer pipeline as an authenticated API datasource to give Appsmith apps merged data without managing upstream keys.

START BUILDING FREE

Frequently Asked Questions

Q:Are Appsmith datasource credentials exposed to users?

No. They stay on the server. Code in JS objects is visible, so keep secrets out of it.

Appsmith Recipes

All Appsmith recipes (2)

Appsmith REST API

Platforms & Frameworks

Appsmith Secure API Proxy for Third Party Credentials

To solve appsmith secure api proxy for third party credentials, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Appsmith Intercom Zendesk

Platforms & Frameworks

Intercom zendesk unified support api low code

Appsmith apps hit CORS and credential limits when calling Intercom and Zendesk. Multi-step Intercom and Zendesk proxy for Appsmith dashboards. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.

Sub-10ms edgeView Recipe

Related Concepts

Low-Code API Integration

Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.

Principle of Least Privilege

The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.

API Aggregation

API Aggregation is the process of combining multiple distinct API calls into a single unified HTTP request. An intermediate edge gateway queries multiple upstream services in parallel, merges the returned data, and delivers a consolidated response to the client, drastically reducing mobile latency and network overhead.