API Connectors

API Connectors let your Web-Nothing apps call external REST APIs at runtime -- weather services, payment gateways, CRMs, notification services, and more. You set up the connection once, and your app can use it across multiple actions.

---

How It Works

1. Create a connector with a name, base URL, and credentials
2. Build an app that uses external APIs (the AI detects API references in your prompt)
3. Bind the connector to the app in the settings panel
4. Your app calls the API when users trigger actions (or on a schedule)

Credentials are encrypted at rest and only decrypted at the moment of the API call. They are never exposed in the browser or in any API response.

---

Creating a Connector

From the Workspace

1. Open an app that uses external APIs.
2. Click Configure Connectors in the connector bindings panel.
3. Click + New Connector and fill in:

4. Click Save. The connector is now available for binding.

Auth Types

Custom Ports

By default, connectors only allow ports 80 and 443. If your API uses a custom port, you can configure up to 5 additional ports in the range 1024-65535.

---

Binding Connectors to Apps

When the AI generates an app with API-connected actions, each action has a connector slot -- a logical name like "weather_api" or "payment_service". You bind your connector to the slot in the app's settings.

This design means the same app template can be used by different people, each with their own API keys.

Steps

1. Open the app in the workspace editor.
2. The Connector Bindings panel appears below the app if there are unbound slots.
3. For each slot, select one of your connectors from the dropdown.
4. Click Save Bindings.

---

Scheduled API Calls

API call actions can run automatically on a schedule, keeping your app's data fresh without manual intervention.

Supported Intervals

Scheduled actions are managed in the app settings. Each scheduled action shows its last run time and status (success or error).

---

Response Mapping

When an API returns data, the platform maps the response to your app's data table fields:

1. Explicit mapping -- if the action specifies which API field goes to which app field, that mapping is used first
2. Exact name match -- API fields that exactly match your data table field names are mapped automatically
3. Fuzzy matching -- remaining fields are matched by normalized names (e.g., stargazers_count matches stargazersCount)

If no fields match at all, the entire response is stored as a text field for manual inspection.

Array responses automatically create multiple records (up to 30 per call).

---

Rate Limits

API calls are rate-limited at three levels:

All three limits must pass before a request is sent. If any limit is exceeded, the call is rejected with a descriptive error.

---

Security

All outbound API calls go through multiple security layers:

• Credential encryption -- AES-256-GCM encryption at rest. Credentials are only decrypted at call time and never logged or exposed
• SSRF protection -- private IP ranges, loopback addresses, and dangerous ports are blocked. DNS results are verified to be public IPs
• DNS pinning -- resolved IPs are pinned to prevent DNS rebinding attacks
• Redirect blocking -- HTTP redirects are not followed automatically
• Response size limit -- responses over 256 KB are aborted
• Request timeout -- 15-second timeout on all outbound calls
• Header sanitization -- dangerous headers (host, transfer-encoding, etc.) are silently stripped
• Input sanitization -- path traversal attempts (../) in URL templates are blocked

---

Limits

---

Example: Weather Dashboard

Here is a typical flow for building a weather dashboard:

1. Create a connector:

   • Name: "WeatherAPI"
   • Base URL: https://api.weatherapi.com/v1
   • Auth: API Key
   • Credentials: your WeatherAPI key

2. Create the app with a prompt like:

   "Weather dashboard that fetches current conditions for a city, with temperature, humidity, wind speed, and a description"

3. Bind the connector to the weather_api slot in the app settings.

4. Use the app: Click the "Fetch Weather" button (or let the hourly schedule run). The API response is automatically mapped to your data table fields.

---

Related