Bubble API Connector fields marked Private are kept on Bubble servers, but unmarked values can reach the browser. Set privacy rules on every data type, require authentication on backend workflow endpoints, and proxy calls that need complex secret handling.
Kept server-side when the Private box is checked.
Admin-level access to your app data.
Unchecked shared headers and parameters can be sent from the browser.
Without rules, Bubble data can be searched by any user.
Public workflow endpoints can be triggered by anyone who finds the URL.
Users can query records that belong to others.
Call RealComposer from the API Connector with the client token marked Private, and let the pipeline handle multi-API aggregation and slimming.
When marked Private, yes. Unmarked fields may be visible to clients.
To prevent API keys from leaking through the Bubble.io API Connector, route high-value third-party requests through RealComposer. RealComposer stores credentials encrypted at the edge and filters bloated responses, reducing the payload size that Bubble servers must parse.
You should not store Intercom credentials in Bubble.io client code. Removes Intercom PAT from Bubble connector configuration and network logs. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Salesforce credentials in Bubble.io client code. RealComposer mediates Salesforce REST for Bubble workflows. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Paddle credentials in Bubble.io client code. Paddle customer portal data without exposing vendor API keys. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To combine mailchimp with shopify customer tags, use one RealComposer pipeline with parallel steps. Shopify customer tags and Mailchimp list membership for segmentation UI. Your Bubble.io app makes one request instead of several sequential upstream calls.
To solve bubble io api connector response too slow how to speed up, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
Edge Secret InjectionEdge Secret Injection is a security pattern where sensitive upstream API credentials (e.g. Stripe Secret Keys, OpenAI Tokens) are stored in an encrypted vault and injected into HTTP request headers exclusively at the edge runtime, ensuring client browsers and mobile apps never see or store the keys.