WeWeb publishes a front-end app, so collection settings, workflow actions, and variables reach the browser. The optional WeWeb server proxy solves CORS, not secret storage. Keep upstream keys behind a backend or edge proxy and send only user or client tokens from WeWeb.
Part of the published app. Treat as public.
Issued per user by your auth plugin and short-lived.
Belong in a backend or edge vault, never in the editor.
Pass the logged-in user token to your proxy and let it decide which upstream calls are allowed.
A single aggregated call per page avoids waterfalls of collection fetches on load.
The values are published with the app and readable in DevTools.
Proxying a request only changes where it is sent from. Headers defined in the app are still public.
Point WeWeb collections and workflows at RealComposer edge URLs with allowed origins set to your WeWeb domains. The pipeline injects vault secrets and returns only the fields your bindings use.
Only publishable keys. Secret keys belong behind a proxy because collection configuration ships to the browser.
An OpenAI key pasted into a WeWeb REST action is published with the app and readable in DevTools. Send WeWeb requests to a RealComposer pipeline instead. The edge injects OPENAI_API_KEY from the vault, checks the calling origin, and returns only the assistant message text.
WeWeb CORS errors happen when an API does not allow your WeWeb domain as an origin. Rather than adding auth headers to a proxied request in the app, call a RealComposer pipeline. It answers the OPTIONS preflight, returns the correct CORS headers, and attaches upstream credentials at the edge.
WeWeb pages that fetch several collections on load wait for each request and expose any keys used. A RealComposer pipeline calls Supabase and Stripe in parallel at the edge, injects both credentials from the vault, and returns one merged JSON object you bind as a single WeWeb collection.
Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.
Allowed Origins (Origin Allowlist)Allowed origins are a configured list of website domains permitted to call an API from a browser. The server or gateway checks the Origin header of each request and only returns CORS permission headers, or accepts the request, when the origin is on the allowlist.
CORS Preflight & Edge ProxyingCross-Origin Resource Sharing (CORS) is a browser security protocol that restricts web applications from making API requests to a different domain unless the server explicitly grants permission via HTTP headers. Edge proxies resolve CORS errors by terminating browser preflight OPTIONS requests directly at the edge.