ZapBounce

ZapBounce and Bubble

Bubble can call an API from the client or from a backend workflow, and for verification only one of those is safe.

A client-side call puts the key in the browser, where anyone with developer tools can take it and spend your credits. This is the single most important thing on this page.

A client-side API call publishes your key

Bubble's API Connector can be configured to run in the client, which is convenient and means the request, including the Authorization header, is visible in the browser's network tab.

Anyone who signs up for your app can then read the key and use it. The first sign is usually a credit balance dropping faster than your signup rate explains.

The backend workflow route costs one extra step to configure and keeps the key on Bubble's server, where it belongs.

How the data moves

  1. Configure the API Connector as server-side

    The setting that matters. Server-side means the call originates from Bubble's infrastructure with the key never reaching the browser.

  2. Call it from a backend workflow

    Triggered by the signup action, so the verdict is attached to the user record as it is created.

  3. Store the verdict on the user thing

    A field on the User type, so conditions elsewhere in the app can read it.

  4. Fail open on the signup path

    If the call errors or times out, create the user anyway. A verifier having a slow second should not cost you a registration.

Setting it up

  1. Add the verify endpoint to the API Connector, configured to run server-side.
  2. Store the key in the connector's shared header, not in a page parameter.
  3. Create a backend workflow that calls it and writes the verdict to the User record.
  4. Trigger that workflow from the signup action.
  5. Add a fallback so an API error still creates the user with an unknown verdict.
  6. Confirm in the browser network tab that no request to the verify endpoint appears client-side.

Bubble: common questions

Can I call the API from the client?

You can, and your key becomes public. Configure the connector as server-side and call it from a backend workflow.

Should signup block on an invalid verdict?

Block on an invalid result, and on the disposable flag if trial abuse matters. Never block on catch-all or unknown.

How do I check my key is not exposed?

Open the browser network tab during a signup. If a request to the verify endpoint appears there, the key is public.

Reference

Check a Bubble export today

100 free checks a month, no card. Unknown results and duplicates are never billed.

Get an API keySee pricing