How to design a crypto exchange app in Bubble

A crypto exchange in Bubble is built by combining Bubble’s normal database + workflows with external real crypto APIs. Bubble itself cannot execute blockchain transactions, so you rely on providers like Coinbase, Binance, CryptoCompare, or a custodial service. Your Bubble app handles users, orders, balances (as database entries), security (Privacy Rules), and triggers API calls to the crypto provider when users buy/sell.

Core Architecture

You need four real pieces: user accounts, wallet records in your Bubble database, API Connector calls to a crypto pricing/trading provider, and backend workflows that run securely on the server. Users never interact directly with external exchanges — Bubble workflows do.

• User: standard Bubble user with email/login + KYC fields if required.
• Wallet: a data type storing balances like BTC\_balance or a list of “Assets.”
• Order: stores buy/sell requests until confirmed.
• Price Feed: API call returning current crypto prices.

Real Bubble Flow

When a user clicks Buy, Bubble creates an Order, calls the external API for price + transaction execution, then updates the database. You show prices using a repeating API call. All sensitive workflows must be backend-only + protected by Privacy Rules.

• Use API Connector to get live market prices.
• Use Backend workflows for Buy/Sell actions to avoid exposing API keys.
• Use Safelist IP feature on the crypto provider if available.

// Example of a real GET price call you might use in API Connector
// (CryptoCompare public endpoint)
{
  "url": "https://min-api.cryptocompare.com/data/price?fsym=BTC&tsyms=USD"
}

Database Strategy

Bubble doesn’t hold real coins. You store balances mirrored from the provider. When the provider confirms a trade, Bubble updates Wallet values through a backend workflow.

• Wallet: fields like BTC, ETH, USDC (number fields).
• Order: fields like type (Buy/Sell), amount, price, status.
• Transaction: store every confirmed trade for audit.

Security + Privacy Rules

Restrict Wallet, Order, and Transaction so only “Current User” can read their own data. Mark all trading workflows as backend-only and use “Ignore privacy rules” only when absolutely needed internally.

• Never store API keys in the page.
• Always use backend workflow when sending money or executing trades.