Connect Bubble to Azure Machine Learning by configuring the API Connector with Azure AD service principal credentials. For inference endpoints, the simplest path is the endpoint-specific API key from Azure ML Studio — no OAuth required. For management API access, use a Backend Workflow to exchange client credentials for a short-lived Bearer token and refresh it every hour.
| Fact | Value |
|---|---|
| Tool | Azure Machine Learning |
| Category | AI & ML |
| Method | Bubble API Connector |
| Difficulty | Advanced |
| Time required | 60–90 minutes |
| Last updated | July 2026 |
Two auth paths for Azure ML in Bubble
Azure Machine Learning exposes two types of REST endpoints with different authentication methods. Online inference endpoints — where you send data and get predictions back — support a dedicated per-endpoint API key that you copy from Azure ML Studio. This key acts as a Bearer token and is the fastest way to get predictions working in Bubble. The second path, the Azure management API, requires Azure AD service principal authentication: you register an app in Azure Portal, assign it the AzureML Data Scientist role, and exchange client credentials for a short-lived Bearer token (valid 3,600 seconds). Bubble's API Connector handles both via Private headers, keeping credentials server-side. This tutorial covers the simpler inference key path first, then the full Azure AD flow for teams who need management API access alongside predictions.
Integration method
Call Azure ML inference endpoints using endpoint-specific API keys (simple path) or Azure AD Bearer tokens (management API path) — both stored as Private headers in Bubble's API Connector.
Prerequisites
- An Azure subscription with an Azure Machine Learning workspace created
- A model deployed as an online endpoint in Azure ML Studio (Endpoints section)
- Access to Azure ML Studio at ml.azure.com to retrieve endpoint URL and API key
- A Bubble app on any plan for the inference key path; Bubble Starter plan or above for Backend Workflow token refresh
- Bubble's API Connector plugin installed (Plugins tab → Add plugins → search 'API Connector')
Step-by-step guide
Retrieve your Azure ML inference endpoint URL and API key
Open Azure ML Studio at ml.azure.com and navigate to Endpoints in the left sidebar. Click on your deployed online endpoint, then open the Consume tab. You will see two items: the REST endpoint URL (looks like https://{endpoint-name}.{region}.inference.ml.azure.com/score) and two API keys — Primary key and Secondary key. Copy the endpoint URL and the Primary key. Keep these open in a separate tab as you'll paste them into Bubble shortly. Important note: this inference endpoint URL is completely different from the Azure management API URL (management.azure.com). The Consume tab gives you the correct URL for submitting predictions. If your endpoint URL does not end in /score, double-check that you're looking at an Online endpoint, not a Batch endpoint — batch endpoints work differently and require a separate Bubble workflow pattern. Also note the Input schema on the Consume tab — it shows the expected JSON shape your model accepts. Screenshot or copy this schema; you'll need it when building the request body in Step 4.
Pro tip: Use the Primary key for production and keep the Secondary key in reserve. If you ever rotate the Primary key, you can immediately switch to Secondary in Bubble while the new Primary propagates.
Expected result: You have the inference endpoint URL (ending in /score) and an API key copied and ready to use.
Install the API Connector plugin and create the Azure ML API group
In your Bubble editor, click the Plugins tab in the left sidebar. Click 'Add plugins', search for 'API Connector', and install the plugin by Bubble. Once installed, click 'Add another API' to create a new API group. Name the group 'Azure ML'. In the Authentication field, leave it on 'None or self-handled' — you will add the auth header manually as a shared header below, which gives you full control over the header name and keeps the value server-side. Under Shared headers, click 'Add a shared header'. Set the key to Authorization and the value to Bearer YOUR_API_KEY — but do not type the key directly. Instead, type Bearer (with a space after it), then click the blue token icon to add a parameter. Name the parameter azure_ml_key, check the 'Private' checkbox, and set the default value to your actual API key. The Private checkbox is critical: it ensures the key is injected server-side by Bubble's infrastructure and never appears in browser network requests. Set the base URL to the first portion of your endpoint URL, up to but not including /score — for example https://my-endpoint.eastus.inference.ml.azure.com.
1{2 "api_name": "Azure ML",3 "base_url": "https://{endpoint-name}.{region}.inference.ml.azure.com",4 "shared_headers": {5 "Authorization": "Bearer <azure_ml_key: PRIVATE>"6 }7}Pro tip: If you have multiple Azure ML endpoints (e.g., one for staging and one for production), create separate API groups in the API Connector with different base URLs and keys, rather than trying to parameterize the domain.
Expected result: The Azure ML API group is created with the Authorization header marked Private. No key is visible in plaintext in the Bubble editor.
Add the prediction call and initialize it with a test request
Within the Azure ML API group, click 'Add a new call'. Name it 'getPrediction'. Set the method to POST and the path to /score — this combines with your base URL to form the full inference endpoint URL. In the Body section, switch the content type to JSON/Body. You need to enter a valid prediction request body that matches your model's expected input schema. Azure ML's standard format wraps inputs in an 'input_data' object (for MLflow models) or an 'instances' array (for other formats). Check your model's Consume tab to see which format it expects. For a typical MLflow classification model the body looks like: { "input_data": { "columns": ["feature1", "feature2", "feature3"], "data": [[<value1>, <value2>, <value3>]] } } For the initialize call, you must provide a real valid input that your model will accept and return a successful response for. Click 'Initialize call'. Bubble will make a live POST to your endpoint using your Private key. If the model is running and your input is valid, you'll see a JSON response with predictions. Bubble will parse the response shape and allow you to reference fields by path in your workflows. If initialization fails with a 400 error, your input schema doesn't match the model's expected format — go back to the Consume tab in Azure ML Studio and verify the sample request body shown there. If you get a 401, double-check that the Private header value is correctly set to Bearer followed by a space and then the key.
1{2 "method": "POST",3 "url": "https://{endpoint-name}.{region}.inference.ml.azure.com/score",4 "headers": {5 "Authorization": "Bearer <private>",6 "Content-Type": "application/json"7 },8 "body": {9 "input_data": {10 "columns": ["age", "subscription_plan", "support_tickets"],11 "data": [[35, "pro", 2]]12 }13 }14}Pro tip: If your model returns probabilities for multiple classes, the response will be an array of arrays. Use Bubble's JSON path to extract the relevant value — for example, 'predictions[0][1]' to get the probability of class index 1.
Expected result: The initialize call succeeds, Bubble parses the response, and you can see the prediction fields available for use in workflows.
Build the Bubble workflow to send predictions and display results
Now wire the API call to a user-facing form. In the Bubble editor, design a page with Input elements for each feature your model expects — for example, three Number inputs for age, plan type, and support ticket count. Add a Button element labeled 'Get Prediction'. Click the button, open the workflow editor, and add a step: 'Plugins → Azure ML - getPrediction'. In the body parameter fields that appear, map each input field to the corresponding model feature. Bubble automatically shows parameter fields for the dynamic parts of your request body. After the API call step, add another workflow step to store or display the result. To show the prediction score directly, you can use a 'Display data' action to put the API response value into a Custom State, then display that Custom State in a Text element. For more complex flows — such as saving the prediction to a database record — add a 'Make changes to a Thing' step after the API call and reference the response path. Make sure the database type has a field for the score (e.g., a Number field called 'prediction_score'). Always add a Bubble error workflow for this API call: click the 'Add an action' in the workflow, go to 'General' → 'Custom error handling'. Log the error details to a database record or display a friendly message — Azure ML endpoints can return 503 during cold starts or if the compute cluster needs to scale up.
Pro tip: Consider adding a loading spinner (show it before the API call step, hide it in the next step) — Azure ML online endpoint response times vary from 200ms to several seconds depending on model complexity and compute type.
Expected result: Clicking the Predict button triggers the API call, and the prediction score appears in the UI or is saved to the Bubble database.
Set up Azure AD service principal auth for management API access (optional)
If you need to call the Azure management API — for example to list available model versions, check deployment status, or fetch workspace metadata — you need Azure AD service principal authentication, not the endpoint API key. This step covers that more complex path. If you only need to call the inference endpoint, you can skip this step. First, in Azure Portal, go to Azure Active Directory → App registrations → New registration. Name it something like 'Bubble ML App'. After creation, note the Application (client) ID and Directory (tenant) ID from the Overview page. Then go to Certificates & secrets → New client secret, create a secret, and copy the value immediately (it won't be shown again). Next, assign this service principal the AzureML Data Scientist role: go to your Azure ML workspace in the Portal → Access control (IAM) → Add role assignment → select 'AzureML Data Scientist' → assign to your app registration. In Bubble, create a new API Connector call (you can add it to the Azure ML group) named 'getAzureToken'. Set method to POST and URL to https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token. Set the body type to 'x-www-form-urlencoded' and add these parameters: grant_type=client_credentials, client_id={your_client_id}, client_secret={your_client_secret, marked Private}, scope=https://management.azure.com/.default. Initialize this call — it should return an access_token string and expires_in: 3600. Then create a Backend Workflow (requires Bubble paid plan) that runs this getAzureToken call on page load or before management API calls, stores the access_token in the current User's field 'azure_ml_token', and sets a 'azure_token_expiry' datetime field to Current date/time + 3600 seconds. Before each management API call, check if the current time exceeds the expiry and refresh if needed.
1{2 "method": "POST",3 "url": "https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token",4 "headers": {5 "Content-Type": "application/x-www-form-urlencoded"6 },7 "body": {8 "grant_type": "client_credentials",9 "client_id": "<your_client_id>",10 "client_secret": "<private: your_client_secret>",11 "scope": "https://management.azure.com/.default"12 }13}Pro tip: The scope value for Azure ML management API must be https://management.azure.com/.default — note the /.default suffix. Using the Dynamics or other Azure service scope here will return a token that Azure ML management API rejects with a 403.
Expected result: The token exchange call succeeds and returns an access_token. Your Backend Workflow stores it with an expiry timestamp and it can be used in management API calls.
Add privacy rules for any Bubble data created from Azure ML responses
If your Bubble app stores prediction results in the database — for example, a 'PredictionRecord' data type with score, input features, and the user who ran it — you must configure Bubble's privacy rules to control who can read and modify these records. Go to the Data tab in Bubble's editor → Privacy. Select the data type you created for storing predictions. By default, Bubble may expose all fields to any logged-in user. Add privacy rules that restrict reads to: 'Current User is the record's owner' or equivalent. This is especially important if prediction inputs contain sensitive business data. Also check that your API Connector calls don't expose the azure_ml_key through workflow logs. Go to Logs tab → check 'Log API calls' settings. In Bubble's API Connector, Private parameters are redacted in logs by default — but double-check that no raw key values appear in any workflow conditions or debug output. For production apps, periodically rotate your Azure ML endpoint API key in Azure ML Studio (Endpoints → your endpoint → Consume → Regenerate primary key) and update the Private parameter value in Bubble's API Connector settings. RapidDev's team has set up dozens of Azure ML integrations like this — if you want a free scoping call to review your architecture, visit rapidevelopers.com/contact.
Pro tip: Bubble's WU (Workload Units) counter charges for each API call made through workflows. If you're running predictions for many users concurrently, check your WU consumption in Bubble's Logs tab to ensure you're on the right pricing plan.
Expected result: Privacy rules restrict prediction data to appropriate users, and you've confirmed that API keys don't appear in logs or workflow outputs.
Common use cases
Custom prediction portal for business teams
Enterprise teams with ML models deployed on Azure ML want non-technical business users to submit prediction requests — for example, entering customer data into a Bubble form to get churn risk scores — without needing access to the Azure portal or Python notebooks.
Build a Bubble page with input fields for customer age, subscription plan, and support ticket count. On button click, POST these values to our Azure ML endpoint and display the churn probability score in a Text element.
Copy this prompt to try it in Bubble
Batch scoring dashboard
Operations teams need to process multiple records through a deployed model and view results in a sortable table. Bubble's Repeating Group can display scored records, with each row triggered by an individual prediction call or a batch passed as an instances array.
Create a Bubble Repeating Group that displays all records from our 'Leads' data type. Add a workflow button that loops through the list and POSTs each lead's features to the Azure ML endpoint, storing the predicted score back in the Lead record.
Copy this prompt to try it in Bubble
Real-time fraud detection in payment flows
Fintech teams deploying fraud detection models on Azure ML can wire Bubble's payment submission workflow to call the ML endpoint before processing — flagging high-risk transactions for manual review rather than allowing them through automatically.
Add a step in Bubble's checkout workflow: before creating the payment record, POST transaction amount, merchant category, and user location to the Azure ML fraud model endpoint. If the predicted fraud score exceeds 0.8, show an alert and pause submission.
Copy this prompt to try it in Bubble
Troubleshooting
API call returns 401 Unauthorized
Cause: The Authorization header value is malformed — either the Bearer prefix is missing, there's a double space between Bearer and the key, or the Private parameter value was not saved after entering the key.
Solution: In the API Connector, click on your Azure ML API group and check the shared header. The value should be exactly 'Bearer ' followed immediately by the parameter token — no extra spaces. Click the Private parameter, verify the default value contains your actual key, and click Save. Re-initialize the call after saving.
Initialize call fails with 'There was an issue setting up your call'
Cause: The initialize call requires a real, valid API response. If the request body doesn't match the model's expected input schema, or if the endpoint URL is wrong, Azure ML returns an error and Bubble cannot parse the response shape.
Solution: Go to Azure ML Studio → Endpoints → your endpoint → Consume tab → Sample request. Copy the exact sample body shown there and paste it into Bubble's initialize call body. Also verify the endpoint URL: it should end in /score, not in /api or any other path. If you're using an MLflow model, the body format uses 'input_data'; for other model types it may be 'instances'.
Azure AD token exchange returns AADSTS error (management API path)
Cause: The scope parameter is incorrect, the service principal doesn't have the required role assignment, or admin consent hasn't been granted in Azure AD.
Solution: Check three things: (1) The scope must be https://management.azure.com/.default — not a generic Microsoft scope. (2) Go to your Azure ML workspace → Access control (IAM) and confirm the service principal appears with AzureML Data Scientist role. (3) In Azure AD → App registrations → your app → API permissions → verify no admin consent is required, or contact your Azure admin to grant it. Also confirm that the tenant_id in the token URL matches the tenant where your Azure ML workspace lives.
Azure Bearer token works initially but fails mid-session with 401
Cause: Azure AD Bearer tokens expire after 3,600 seconds (1 hour). If your Backend Workflow doesn't refresh the token before expiry, API calls start failing when the stored token becomes invalid.
Solution: Add a condition before every management API workflow: check if 'Current date/time > User's azure_token_expiry'. If true, trigger the token refresh Backend Workflow first, wait for it to complete, then proceed with the API call. Alternatively, set a proactive refresh — trigger the token workflow every 50 minutes using Bubble's recurring Backend Workflow to stay ahead of expiry.
Backend Workflow is unavailable or greyed out in the editor
Cause: Backend Workflows (API Workflows) require a paid Bubble plan. The Free plan does not include this feature.
Solution: Upgrade to Bubble Starter plan or above to unlock Backend Workflows. The Backend Workflow is only required for the Azure AD token refresh path — if you're using the inference endpoint API key (Step 1-4), you don't need Backend Workflows at all.
Best practices
- Use the inference endpoint API key (from Azure ML Studio → Endpoints → Consume) for prediction calls — it's simpler than Azure AD OAuth and sufficient for most Bubble use cases.
- Always mark API keys and client secrets as Private in Bubble's API Connector — this keeps credentials on Bubble's servers and out of browser network requests.
- Store token expiry timestamps in the Bubble database alongside Bearer tokens — implement a refresh check before every management API call to avoid mid-session 401 errors.
- Set Bubble privacy rules on any data type that stores prediction inputs or outputs — especially if inputs contain sensitive business or customer data.
- Add explicit error handling workflows for Azure ML API calls — online endpoints can return 503 during cold starts or auto-scaling events, so show a user-friendly retry message rather than a raw error.
- Cache prediction results in the Bubble database when the same inputs are likely to be resubmitted — this reduces both Azure ML compute costs and Bubble WU consumption.
- Use Bubble's Logs tab to monitor WU usage from prediction API calls — high-frequency prediction workflows can accumulate significant WU charges on traffic-heavy Bubble apps.
- Keep inference endpoint API keys rotated periodically via Azure ML Studio → Endpoints → Regenerate key, and update the Private parameter in Bubble's API Connector to match.
Alternatives
Vertex AI is the Google Cloud equivalent — both require cloud IAM authentication and support custom model deployments. Choose Azure ML if your team is already in the Microsoft 365 ecosystem; choose Vertex AI if your data infrastructure is on Google Cloud.
OpenAI is the simpler option if you need a general-purpose language model: persistent API key, no token refresh, immediate access. Azure ML is the choice when you've trained your own model and need to deploy it in your organization's Azure environment with enterprise compliance controls.
TensorFlow Serving is self-managed infrastructure you host yourself — more control but higher operational overhead. Azure ML is a managed platform where Microsoft handles infrastructure scaling and availability. Choose TF Serving if you want full control; choose Azure ML for managed enterprise deployment.
Frequently asked questions
Do I need the Azure AD service principal setup, or is the endpoint API key enough?
For prediction calls only, the endpoint API key is all you need — it's available from Azure ML Studio → Endpoints → Consume tab and works as a Bearer token directly. The Azure AD service principal setup is only required if you need to call the Azure management API (listing models, workspaces, experiments). Start with the endpoint key; add Azure AD only if you need management access.
Why does the inference endpoint URL look different from the management API URL?
Azure ML has two completely separate API surfaces. Inference endpoints have URLs like https://{endpoint-name}.{region}.inference.ml.azure.com/score — these are customer-facing prediction APIs. The management API at management.azure.com handles workspace configuration and model metadata. They use different base URLs and different authentication (endpoint key vs Azure AD Bearer token).
Can I call multiple Azure ML models from the same Bubble app?
Yes — create a separate API call in the Azure ML API Connector group for each model endpoint. Each endpoint has its own /score URL and its own API key. Add them as separate calls with different names (e.g., 'getChurnPrediction', 'getFraudScore') within the same API group, each with a unique Private parameter for its key.
What does 'initialize call' mean and why do I have to do it?
Bubble's initialize call is a one-time live request that lets Bubble learn the shape of the API response. Until Bubble sees a real response, it doesn't know what fields are available for use in workflows. You must provide a valid request body that your model will accept — the initialize call will fail if the body is wrong or if the endpoint is down. Re-initialize any time the response schema changes.
Do Backend Workflows require a paid Bubble plan?
Yes. Backend Workflows (needed for the Azure AD token refresh logic) are only available on Bubble Starter plan and above — they are not available on the Free plan. If you're using only the inference endpoint API key (without Azure AD token exchange), you don't need Backend Workflows and the Free plan is sufficient for testing.
How do I test my Azure ML integration before deploying to production in Bubble?
Use Bubble's built-in Workflow debugger (enable it from the top bar when previewing your app). Step through the workflow manually and expand the API call step to see the exact request and response. You can also check Bubble's Logs tab → API calls to see historical requests. For Azure ML itself, use the Test tab in Azure ML Studio → Endpoints to verify the model responds correctly before connecting Bubble.
Talk to an Expert
Our team has built 600+ apps. Get personalized help with your project.
Book a free consultation