ToolJet data sources store credentials on the ToolJet server, and secret workspace constants resolve server-side in queries. RunJS queries, component properties, and variables run in the browser, so any key placed there is visible to every app user.
Stored and applied by the ToolJet server when queries run.
Usable in data sources and queries, not in components.
Executed in the browser. Never use for secrets.
Headers and tokens set on the data source are applied server-side and never reach the browser.
Secret constants are masked in the editor and resolved on the server at query time.
Use group permissions so only intended users can run write queries.
RunJS runs in the browser, so the key appears in source and network traffic.
Anyone with the link can trigger queries that run with your stored credentials.
Add a RealComposer pipeline as a REST API data source with the client token in the data source headers, so ToolJet apps receive merged, slimmed JSON without holding upstream secrets.
No. Credentials stay on the ToolJet server. Code in RunJS queries and variables is visible in the browser.
Do not call Stripe from a ToolJet RunJS query, because RunJS executes in the browser and exposes the secret key. Add a RealComposer pipeline as a REST API data source instead. The edge injects STRIPE_SECRET_KEY from the vault and returns a compact customer and subscription object for your tables.
ToolJet CORS errors appear when a RunJS query or browser-side fetch hits an API that does not return Access-Control-Allow-Origin for your ToolJet domain. Route the call through a RealComposer pipeline: it handles the OPTIONS preflight, adds the right headers, and injects any upstream auth from the vault.
Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
Edge Secret InjectionEdge Secret Injection is a security pattern where sensitive upstream API credentials (e.g. Stripe Secret Keys, OpenAI Tokens) are stored in an encrypted vault and injected into HTTP request headers exclusively at the edge runtime, ensuring client browsers and mobile apps never see or store the keys.