Call Airtable API from Wix Velo Securely
Airtable-backed Wix pages without tokens in page code
Wix Velo page code runs in the visitor browser, so an Airtable token used with wix-fetch there is public. Call a RealComposer pipeline from page code with a client token, or from backend code. The edge injects AIRTABLE_PAT, enforces your Wix origins, and returns only the columns your repeater shows.
Why Airtable tokens leak from Wix page code
Wix repeaters are easy to fill with a wix-fetch call in page code, but that code is delivered to every visitor. An exposed personal access token lets anyone read or modify your Airtable base within the scopes you granted.
- Airtable PAT visible in Wix page code and network traffic
- Visitors exhausting the five requests per second base limit
- Internal Airtable columns such as owners sent to every visitor
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save AIRTABLE_PAT and AIRTABLE_BASE_ID in RealComposer so the value never enters the Wix Velo project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Fill a Wix repeater from page code
Call your workspace edge URL with a restricted rc_live_ client token.
import { fetch } from 'wix-fetch';
$w.onReady(async () => {
const res = await fetch('https://realcomposer.com/v1/workspace/call-airtable-from-wix-velo-securely?table=Events', {
headers: { Authorization: 'Bearer rc_live_client_token' },
});
const { items } = await res.json();
$w('#eventsRepeater').data = items.map((r) => ({ _id: r.id, ...r.fields }));
});
{
"records": [
{
"id": "recEv1",
"createdTime": "2026-09-12T08:00:00.000Z",
"fields": {
"Title": "Open House",
"Date": "2026-12-02",
"Owner": "usr1"
}
}
],
"offset": "itrB2/recEv1"
}
{
"items": [
{
"id": "recEv1",
"createdTime": "2026-09-12T08:00:00.000Z",
"fields": {
"Title": "Open House",
"Date": "2026-12-02"
}
}
]
}
Recipe Specs
- HTTP method
- GET
- Upstream calls
- 1
- Edge cache TTL
- 300s
- Client auth
- Restricted client token
- Mapped output fields
- 1
- Payload
- 161 B to 120 B (-25%)
curl -X GET "https://realcomposer.com/v1/workspace/call-airtable-from-wix-velo-securely" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Why not use the Wix Secrets Manager instead?
The Secrets Manager works from backend web modules. RealComposer adds edge caching, payload slimming, and reuse across other sites and apps with the same pipeline.
Why does the page code add an _id field?
Wix repeaters require each item to have a unique _id, so the snippet copies the Airtable record id into that key before binding.
Sources & Definitions Used in This Answer
Deploy this Wix Velo + Airtable Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.