Article

API Key Security for No-Code Apps: Public Keys, Private Keys, and Backend Proxies

WeWeb Free Intermediate

This clears up a mistake that leaks data straight out of Airtable and similar tools: putting a private key in front-end code where anyone can read it. It explains the public-versus-private key distinction and why a private key must sit behind a backend proxy that the browser calls instead. Read it before you connect any service that hands you one all-powerful key.

Only public keys belong in front-end code
A private key in the browser grants full read and write access
Route private keys through a backend proxy the browser calls

Open on weweb.io ↗

The question it answers

How do I add proper user login and role-based access to a no-code app without leaving my data wide open?

Read with it

This is the official, canonical explanation of the one feature that actually protects your data in Bubble. It makes the core... Bubble Docs Article Protecting data with privacy rules Bubble
Your app has a second front door most builders forget: the Data API, a public URL that returns your tables as raw JSON. This... Bubble Docs Article Data API security Bubble
Nothing makes the risk concrete like real numbers, and this audit of over 11,000 live Bubble apps found that most of them leak.... Bubble Forum Thread I Audited 11,026 Bubble Apps for Security, Here's What I Found ankur1
If you learn better by watching someone click through the editor, this is the official video walkthrough of setting up privacy... Bubble Academy Course Bubble Academy: Security and Privacy Bubble
When your app calls a paid service (OpenAI, a payment provider, an email tool), the key can end up visible in the browser if... Bubble Docs Article API Connector security Bubble
This is the number one web security risk, and it is exactly your question: users reaching data they should not. OWASP is the... OWASP Article A01 Broken Access Control (OWASP Top 10) OWASP Foundation

eChai Partner Brands The partnership →