APIs & Backends

API keys: creating, scoping, and revoking them

How key-based authentication works, and limiting a key to specific endpoints.

Using secrets safely in a Call External API block

Storing a third-party API key without exposing it in your endpoint's own config.

Looping over a list with the Loop block

Repeating a set of steps once per item in a list, e.g. results from a Database Query.

Scheduling an endpoint to run automatically

Running an endpoint on a timer instead of waiting for a caller.

Your API's OpenAPI spec, and serving files from an endpoint

Importing your API into Postman/Insomnia, and returning a file instead of JSON.

What happens when an endpoint fails partway through

Automatic rollback of database writes, and viewing exactly what a request sent.

GraphQL, WebSockets, and other things the API Builder doesn't do

Being upfront about a few real gaps, so you don't spend time hunting for them.

Rate limiting, CORS, and authenticating incoming requests

Protecting a published endpoint beyond just requiring an API key.

Collections with a schema, and background jobs

Validating stored data automatically, and running work that takes longer than one request.

Add a health check endpoint

Give monitoring tools, or yourself, a fast, reliable /health you can point anything at.

Client side caching (Cache Control, ETag) and requesting fewer fields

Letting a caller's own browser or CDN skip a request entirely, and trimming what each record returns.

Versioning your API

The recommended way to make a breaking change without breaking existing callers.

Gating an endpoint by a key's role

A simple admin only (or any specific role) check using a Condition and an Error Response block.

Letting your API's visitors sign in with Google (OIDC login)

Verifying a Google (or other OpenID Connect) sign in on behalf of your API's own end users.

Checking an endpoint's graph before you save it

The live VALID/ISSUES badge and the Validate button, catching a broken graph before it ships.