Production-ready templates for calling third-party APIs from WeWebwithout exposing secrets or maintaining a custom backend.
WeWeb safe & unsafe practicesAn OpenAI key pasted into a WeWeb REST action is published with the app and readable in DevTools. Send WeWeb requests to a RealComposer pipeline instead. The edge injects OPENAI_API_KEY from the vault, checks the calling origin, and returns only the assistant message text.
WeWeb pages that fetch several collections on load wait for each request and expose any keys used. A RealComposer pipeline calls Supabase and Stripe in parallel at the edge, injects both credentials from the vault, and returns one merged JSON object you bind as a single WeWeb collection.
WeWeb CORS errors happen when an API does not allow your WeWeb domain as an origin. Rather than adding auth headers to a proxied request in the app, call a RealComposer pipeline. It answers the OPTIONS preflight, returns the correct CORS headers, and attaches upstream credentials at the edge.