If you just implement the ApiFlow api in Flutterflow, when you inspect the page with developer tools and look at the Network Fetch/XHR tab you are able to see the full API URL plus the API Bearer token. You can then copy this and access the API directly and change the API to extract more information, its really easy. Whilst Supabase uses APIs they are able to check the users login token to ensure they should have access and also implement Row Level Security, thus restricting what they can see. For ApiFlow api's you can hide the bearer token by making it private in Flutterflow, for this you need to connect your Flutterflow project to a firestore project that has a Blaze Plan. Create Firebase Project and select Blaze Plan (its cheap, pay as you go) - if you have not done this before for Flutterflow you will need to enable Flutterflow access, check the Flutterflow doc for this. Add firebase to your Flutterflow project in the App Settings section, it wil make deploy Regenerate Config Files this is ok. Next on the same page go to the bottom and open Advanced settings, here you need to set your cloud region. eu-west for example is UK, there is a list showing where all the regions you. You want to pick the one nearest your uses for best performance. For you ApiFlow API, in the API section in Flutterflow go to the advanced settings tab (under the API URL), select Make Private. Then you will see at the top a new box called Deploy Private APIs, click deploy. You can just have a firestore project to secure your APIs, you can still use Supabase as your auth provider and any APIs. This works by relaying the ApiFlow API request via Firestore Cloud where is gets reformatted with the ApiFlow URL and bearer token. Thus nobody will know you are using ApiFlow and will not see your bearer token. With this in place, this is what a hacker would see: https://europe-west2-pointofcaredevicemanagement.cloudfunctions.net/ffPrivateApiCall filter: " (lastname Like \"%%\" or Organisation Like \"%%\" or email Like \"%%\")" This is a working ApiFlow Flow that connects to a MySQL DB and returns a list of data. The suggestion is to advise ApiFlow users to make their API private when proceeding through the setup wizard, perhaps with one of your great videos!
