Wix Velo page and public code run in the visitor browser, while backend web modules run on Wix servers. Store API keys in the Secrets Manager, read them only in backend code, and set web method permissions so anonymous visitors cannot call privileged functions.
Sent to every visitor. Treat as public.
Readable only from backend code.
Use wix-fetch in backend code with secrets loaded from the Secrets Manager.
Restrict privileged backend functions to site members or admins instead of anyone.
Page code runs in the browser, so the header appears in source and network traffic.
Visitors can abuse it to spend your quota or reach internal endpoints.
Call a RealComposer pipeline from Velo page code with a client token and allowed origins set to your Wix domains, or from backend code for privileged flows. Upstream secrets stay in the vault.
No. Page and public code run in the browser. Only backend code and the Secrets Manager stay server-side.
Wix Velo page code runs in the visitor browser, so an Airtable token used with wix-fetch there is public. Call a RealComposer pipeline from page code with a client token, or from backend code. The edge injects AIRTABLE_PAT, enforces your Wix origins, and returns only the columns your repeater shows.
Calling OpenWeather from Wix page code exposes the appid key and spends one call per visitor. A RealComposer pipeline keeps the key in the vault, caches results by location for ten minutes, and returns only temperature, condition, and icon for your Wix weather widget.
Low-code API integration is connecting visual app builders such as Bubble, FlutterFlow, Webflow, and Retool to external APIs through configuration rather than custom backend code. Builders define endpoints, headers, and response mappings inside the platform editor.
Allowed Origins (Origin Allowlist)Allowed origins are a configured list of website domains permitted to call an API from a browser. The server or gateway checks the Origin header of each request and only returns CORS permission headers, or accepts the request, when the origin is on the allowlist.
Server-Side Request Forgery (SSRF) ProtectionServer-Side Request Forgery (SSRF) is a security vulnerability where an attacker tricks a backend server into making unauthorized HTTP requests to internal, non-public resources. Edge SSRF protection validates outgoing URLs, blocking private RFC 1918 subnets, loopbacks, and cloud metadata endpoints.