RealComposer
START FREE
Client PlatformsOfficial Retool docs

Retool Safe & Unsafe Practices

Direct Answer

Retool resources store credentials on the Retool backend, so queries against them do not expose secrets. JavaScript queries, transformers, and temporary state run in the browser, so keys placed there are visible to every user of the app.

Credentials & Where They Belong

Server only
Resource credentials

Stored and used by the Retool backend.

Client safe
Values in JS queries or state

Visible in the browser. Never use for secrets.

Safe Practices

  • Store credentials in resources

    Use REST or database resources so secrets stay server-side.

  • Use least-privilege database users

    Read-only users for dashboards limit damage from mistakes.

  • Apply permission groups per app

    Restrict who can edit apps and use write queries.

Unsafe Practices

  • Putting API keys in JavaScript queries

    They run in the browser and appear in network traffic.

  • Connecting with an admin database user

    Any app editor can run destructive queries.

The RealComposer Pattern

Add a RealComposer pipeline as a REST resource so Retool apps get merged, slimmed data without holding upstream secrets.

START BUILDING FREE

Frequently Asked Questions

Q:Can Retool users see resource credentials?

No. Credentials stay on the Retool backend. Values in JS code or state are visible.

Retool Recipes

All Retool recipes (10)
RetoolREST API
Security & Secret Vault

Retool Public App Hide REST API Credentials

To solve retool public app hide rest api credentials, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
RetoolStripe
Platforms & Frameworks

How to Connect Stripe to Retool Securely

To solve how to connect stripe to retool securely, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
RetoolREST API
Platforms & Frameworks

Retool CORS Error Connecting to External REST API

To solve retool cors error connecting to external rest api, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
RetoolPaddle
Platforms & Frameworks

Retool connect paddle refunds securely

Retool apps hit CORS and credential limits when calling Paddle. Retool queries RealComposer for Paddle write operations. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.

Sub-10ms edgeView Recipe

Related Concepts

Principle of Least Privilege

The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.

Low-Code API Integration

Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.

API Aggregation

API Aggregation is the process of combining multiple distinct API calls into a single unified HTTP request. An intermediate edge gateway queries multiple upstream services in parallel, merges the returned data, and delivers a consolidated response to the client, drastically reducing mobile latency and network overhead.