If I use the REST API plugin in Weweb, are the API keys secured? If not, what’s the best alternative?

From what I understand, as long as the key is passed as a header inside the plugin editor, it’s secure. But if you’re storing the API key as a variable (which is exposed upon page load) or the API key is in the API URL you are calling (such as a parameter), then it would be exposed. Here is a great…

No. You need to keep sensitive keys in and make the calls calls from your backend.

It would be great if there was a place to store the API keys securely inside WeWeb and request it like a variable. It looks like I’m going to have to build (aka faff for many hours) a backend api proxy to handle the API request as there isn’t a secure way in WeWeb. As a nocode builder, this is qui…

I would not recommend using weweb to solve backend problems. That’s more akin to using Bubble. There are many standalone nocode API backends (e.g. Xano, Supabase, Fastgen Buildship, Comnoco, Pipedream to name a few) to solve this problem simply and in a world-class way.

WeWeb is a front end builder, what you build will be executed in the browser and so everything end up exposed publicly. What do you need to secure behind your proxy ? Which API calls exactly with which api keys ? I’m geniunly interested because I already through about how to provide such capabilit…

Hi Alexis, Thanks for your thoughts and it’s insightful to hear the dilema in making such a decision. As, like you say, should you keep focused on developing what is already a great front end builder. I can’t help with the technical side unfortunately and can only offer my perspective. I know it…

Thank you for the analysis @Alexis ! From what you wrote the conclusion is that from nowhere in weweb are we able to make a 100% protected backend communication? Not from the supabase plugin Not from the OpenAi plugin Not from the REST API plugin So even if we use Buildship for example, the pro…

[image] loukas: So even if we use Buildship for example, the proxy you mention, someone could still use the public information of the call from weweb to Buildship and do the same thing… This is safe, if you protect your Buildship endpoint. [image] loukas: Not from the OpenAi plugin Th…

Broberto gave you the correct answer You can split backend services in two categories, some are made to be requested from anywhere including a browser, some are made to be used by others backend and so requested from a server, not a browser. WeWeb is a front end app builder, it will be executed fr…

Lovely explanation! Thank you very much!! Lets think of a case I also mentioned in the original post: the API call that has to be made to Google Maps API to get predictions in the Autofill function presented in perfect functioning detail here: [image] TUTORIAL - How to create the …

Is the API key in the Rest API secure?

Ask us anything

loukas (info@truthservices.co) July 3, 2024, 12:56pm 14

Topic		Replies	Views
100% secure communication with backend? Ask us anything	1	106	July 3, 2024
WeWeb & Supabase - Security Concerns Ask us anything	27	2203	April 5, 2026
Backend connection with our own API Ask us anything	4	106	April 2, 2025
Questions: Security, Supabase and WeWeb and.. my app How do I? supabase	7	366	November 15, 2023
Request to Add Unkey as a Plugin in Weweb Ask us anything	6	96	June 7, 2024

Is the API key in the Rest API secure?

Related topics