# How to authenticate and access controls with API keys in Bubble.io: Step-by-Step

- Tool: Bubble
- Difficulty: Intermediate
- Time required: 20-25 min
- Compatibility: Growth plan+ (requires backend workflows)
- Last updated: March 2026

## TL;DR

Secure your Bubble API endpoints by implementing API key authentication, checking authorization headers in backend workflows, and managing key rotation. This tutorial covers generating secure tokens, validating them on incoming requests, restricting access by IP or user role, and revoking compromised keys.

## Overview: Authenticating API Access with Keys in Bubble

When you expose backend workflows as API endpoints, you need to verify that incoming requests are authorized. This tutorial shows you how to create an API key management system, validate keys on every request, and handle key rotation for security.

## Before you start

- A Bubble app on the Growth plan or higher
- Backend workflows enabled in Settings → API
- Basic understanding of the API Connector and backend workflows
- Familiarity with HTTP headers and authentication concepts

## Step-by-step guide

### 1. Create the API Key data type

Go to the Data tab and create a new Data Type called APIKey. Add fields: key_value (text), name (text — a label for the key), user (User), is_active (yes/no, default yes), created_date (date), and last_used (date). The key_value will store the actual API key string.

**Expected result:** An APIKey data type ready to store and manage API credentials.

### 2. Generate secure API keys

Create an admin page with a Generate Key button. In the workflow, use the Calculate formula action with a random string expression or the Toolbox plugin to generate a 32-character random alphanumeric string. Create a new APIKey with this value, the current user, and is_active set to yes. Display the key to the admin once and advise them to copy it immediately.

> Pro tip: Use a prefix like sk_ for secret keys to help users identify the key type at a glance.

**Expected result:** Admins can generate unique API keys that are stored in the database.

### 3. Validate API keys in backend workflows

In each backend workflow that should be protected, add a first step that searches for an APIKey where key_value equals the incoming authorization header value and is_active is yes. If the search returns empty, use the Terminate this workflow action and return a 401 Unauthorized response. If found, update the last_used field and proceed with the workflow logic.

**Expected result:** Backend workflows reject requests with invalid or missing API keys.

### 4. Add role-based access controls

Add a permissions field (list of text) to the APIKey data type. Store allowed actions like read, write, and admin. In each backend workflow, after validating the key, check if the key permissions list contains the required action. Reject requests where the key does not have sufficient permissions.

**Expected result:** Different API keys can have different permission levels controlling what actions they can perform.

### 5. Implement key rotation and revocation

On the admin page, add a Revoke button next to each key in a Repeating Group. The workflow sets is_active to no. For rotation, add a Rotate button that generates a new key, creates a new APIKey record, and sets the old one to inactive. Display the new key for the admin to distribute.

**Expected result:** Admins can revoke compromised keys instantly and rotate keys without downtime.

## Complete code example

File: `Workflow summary`

```text
API KEY AUTH — WORKFLOW SUMMARY
================================

DATA MODEL
  APIKey:
    - key_value (text): e.g. sk_a1b2c3d4e5f6...
    - name (text): label for the key
    - user (User): key owner
    - is_active (yes/no)
    - permissions (list of text): read, write, admin
    - created_date (date)
    - last_used (date)

BACKEND WORKFLOW: protected_endpoint
  Step 1: Search for APIKey
    - key_value = incoming Authorization header
    - is_active = yes
  Step 2: If Result is empty → Return 401 error
  Step 3: Check permissions contain required action
  Step 4: If insufficient → Return 403 error
  Step 5: Update last_used = Current date/time
  Step 6: Proceed with business logic

ADMIN PAGE WORKFLOWS
  Generate Key:
    Step 1: Generate random 32-char string
    Step 2: Create APIKey (key_value, user, active)
    Step 3: Display key to admin (one time only)

  Revoke Key:
    Step 1: Make changes → is_active = no

  Rotate Key:
    Step 1: Set old key is_active = no
    Step 2: Generate new key
    Step 3: Create new APIKey record
```

## Common mistakes

- **Exposing API keys in frontend elements or URL parameters** — Frontend data is visible in the browser. Keys in URLs appear in server logs and browser history. Fix: Always pass API keys in HTTP headers (Authorization header) and validate them in backend workflows.
- **Not setting key expiration or rotation schedule** — Long-lived keys that are never rotated increase the window of exposure if compromised. Fix: Set a rotation reminder or automatic expiration. Rotate keys every 90 days as a best practice.
- **Returning detailed error messages for invalid keys** — Detailed errors help attackers understand your authentication system. Fix: Return generic error messages like Unauthorized for all auth failures. Log details server-side only.

## Best practices

- Pass API keys in the Authorization header, never in URLs or query parameters
- Generate keys with at least 32 random alphanumeric characters
- Rotate API keys every 90 days as a security best practice
- Log all API key usage with timestamps for audit trails
- Implement rate limiting per API key to prevent abuse
- Revoke keys immediately when they are compromised or no longer needed

## Frequently asked questions

### How long should an API key be?

At least 32 characters of random alphanumeric text. Longer keys (64 characters) provide even more security against brute force attempts.

### Should I hash API keys before storing them?

Ideally yes, similar to passwords. However, Bubble does not have native hashing functions. You can use a plugin or backend service for hashing, or rely on Privacy Rules and database encryption.

### Can I rate limit API requests per key?

Yes. Create a RequestLog data type that records each API call with the key and timestamp. In your validation step, count recent requests and reject if the limit is exceeded.

### What is the difference between API keys and OAuth tokens?

API keys are static credentials for server-to-server communication. OAuth tokens are temporary, user-specific, and support scope-based permissions. Use API keys for backend integrations and OAuth for user-authorized access.

### Can RapidDev help secure my API endpoints?

Yes. RapidDev can implement comprehensive API security including key management, OAuth integration, rate limiting, IP whitelisting, and audit logging.

---

Source: https://www.rapidevelopers.com/bubble-tutorial/authenticate-access-controls-api-keys-bubble
© RapidDev — https://www.rapidevelopers.com/bubble-tutorial/authenticate-access-controls-api-keys-bubble