As an admin
This section covers how to authenticate API clients making incoming requests with full administrative access using a Bubble API token.
Last updated
This section covers how to authenticate API clients making incoming requests with full administrative access using a Bubble API token.
Last updated
Token authentication means that the making a request is authenticating using a token that has been generated under Settings - API using the Generate a new API token button.
This gives the client unrestricted access to the database.
Token authentication gives the client the broadest possible access to your database and API workflows. It should be used with caution.
To set up admin authentication, navigate to Settings - API and scroll down to the button that says Generate a new API token:
When you click the button, Bubble will generate a unique, cryptographically secure 32-character string that serves as the token for any API requests that you want to make. You can create multiple tokens if you have more than one external system connecting to your application. We recommend creating one token per system so that you can revoke them one-by-one if needed.
The token is the same in all versions of your app, but any changes made to it (including creating and deleting a token) needs to be deployed in order to update.
In principle, it gives the same privileges as an admin would get in the Bubble editor, which means there are no limitations to what you can search for, view, create, edit and delete in the database, and you can run all API workflows.
There are a few exceptions:
In the Data API, only data types that you have will be accessible
In the Workflow API, only Workflows that have the box checked will be accessible
Each token you create can have its own label to be easily identifiable. We recommend giving each one a label that clearly indicates what the token is used for. The label does not affect the functioning of the token in any way and is not visible to the client or in your application's client-side code.
To revoke a token, scroll to the relevant token and click the delete icon in the upper right corner.
There is no warning message – the token is deleted by a single click
You cannot undo this action
The change does not apply to your Live version until you deploy
An admin token is valid until it is revoked.
