How to configure the needed parameters for an API call in Bubble.io: Step-by-Ste

The API Connector supports four parameter locations: (1) URL parameters — embedded in the URL path using brackets: /users/[user_id]/posts. The value replaces the bracketed placeholder. (2) Query string parameters — appended after ? in the URL: /search?q=[query]&limit=[limit]. (3) Header parameters — sent in HTTP headers, typically for authentication and content type. (4) Body parameters — sent in the request body for POST, PUT, and PATCH requests. Each location serves a different purpose defined by the API you are connecting to. Check the external API's documentation to know which parameters go where.

In the API Connector, wrap URL path parameters in square brackets: https://api.example.com/users/[user_id]. For query strings, add them to the URL: https://api.example.com/search?q=[search_term]&page=[page_num]. Bracketed values become dynamic parameters you can fill in when using the API call in workflows. To make a parameter static (same value every time), remove the brackets and type the fixed value directly. Use dynamic parameters for values that change per request (user IDs, search terms) and static parameters for values that are always the same (API version, fixed filters).

Click Add header in the API Connector call configuration. Common headers include: Authorization (for API keys or tokens), Content-Type (usually application/json for REST APIs), and Accept (what format you want back). For API key authentication, add a header: key = Authorization, value = Bearer [your_api_key]. Check the Private checkbox to keep the key server-side. For shared headers used across all calls, add them in the Shared headers section at the top of the API configuration — they automatically apply to every call.

For POST, PUT, and PATCH requests, click the Body tab in the API Connector. Set Body type to JSON. Add your request body structure. Use bracketed placeholders for dynamic values: {"name": "[name]", "email": "[email]", "role": "admin"}. Dynamic parameters (in brackets) can be filled when the call is used in workflows. Static values (no brackets) are sent as-is every time. For nested objects, structure the JSON accordingly. For list parameters, use JSON arrays. Initialize the call with sample values to verify the body structure is correct.

Each parameter has two important checkboxes: Private and Client safe. Private means the value is NEVER sent to the user's browser — the API call routes through Bubble's server. Use Private for API keys, secrets, and any sensitive data. Client safe means the value CAN be set dynamically in the browser editor but is still transmitted to the server. NEVER use Client safe for sensitive data. For most API keys: check Private, leave Client safe unchecked. For dynamic user input (search terms, IDs): leave both unchecked. The initialization value for Private parameters becomes the default — change it in production.