JFrog Artifactory

Before opening FlutterFlow, generate the credential you'll use for API calls. Artifactory supports two authentication methods: **Access Tokens (recommended, modern path):** Log into your JFrog Platform (yourcompany.jfrog.io for Cloud) → go to Administration → User Management → Access Tokens → Generate Token. Set a descriptive name like 'FlutterFlow Dashboard Read-Only', set an expiration date, and assign a scope of 'Reader' or read-only. This generates a long-lived token you'll use with the `Authorization: Bearer` header. **API Keys (legacy path):** In your JFrog Platform, click your profile avatar → Edit Profile → Unlock the API Key section → Generate. API keys are scoped to your user account's permissions and use the `X-JFrog-Art-Api` header. Note: JFrog is gradually deprecating API keys in favor of access tokens — prefer tokens for new setups. Critical security note: a full-access Artifactory token or API key can delete artifacts, modify repositories, and change permissions. For a phone dashboard with read-only needs, always generate a read-only credential. A leaked read-only token allows someone to see your artifact inventory — serious but recoverable. A leaked admin token allows deleting your entire artifact storage. Copy the generated token or API key. For tokens, you'll only see the full value once — copy it immediately.

Open FlutterFlow and click API Calls in the left navigation panel → + Add → Create API Group. The base URL is critical: it must end in `/artifactory`. For JFrog Cloud this is `https://yourcompany.jfrog.io/artifactory`; for self-hosted it is `https://artifactory.yourcompany.com/artifactory` (or whatever hostname your instance uses). If the base URL is missing the `/artifactory` segment, every API call will return 404 — this is the second most common setup mistake. Set the Group Name to `Artifactory`. In the Headers section, add your auth header: **If using an access token (recommended):** - Header Name: `Authorization` - Header Value: `Bearer [App Constant: ARTIFACTORY_TOKEN]` **If using an API key (legacy):** - Header Name: `X-JFrog-Art-Api` - Header Value: `[App Constant: ARTIFACTORY_API_KEY]` Note: the header name `X-JFrog-Art-Api` is case-sensitive — Artifactory is strict about the casing. Using `x-jfrog-art-api` (all lowercase) or `X-Jfrog-Art-Api` (wrong capitalization) will return a 401 even with a valid API key. Store the credential as an App Constant: go to Settings & Integrations → App Settings → App Constants → add a constant named `ARTIFACTORY_TOKEN` (or `ARTIFACTORY_API_KEY`) and paste the value. Also add a `Content-Type: application/json` header for standard REST calls — you'll override this for AQL calls in a separate API Call configuration. Click Save.

1{
2  "api_group_name": "Artifactory",
3  "base_url": "https://yourcompany.jfrog.io/artifactory",
4  "headers": [
5    {
6      "name": "Authorization",
7      "value": "Bearer [App Constant: ARTIFACTORY_TOKEN]"
8    },
9    {
10      "name": "Content-Type",
11      "value": "application/json"
12    }
13  ]
14}

With the API Group configured, add your first API Call to list repositories. Inside the Artifactory API Group, click + Add API Call: - **Call Name:** `GetRepositories` - **Method:** GET - **Endpoint (relative):** `api/repositories` This calls `https://yourcompany.jfrog.io/artifactory/api/repositories` and returns a JSON array of repository objects. In the Response & Test tab, click Test. If you see a 200 response, great — paste or use the live response to generate JSON Paths. The response is a flat array of objects, so JSON Path expressions are straightforward: - `repo_key` → `$[*].key` (repository identifier, e.g., 'docker-local') - `repo_type` → `$[*].type` (LOCAL, REMOTE, or VIRTUAL) - `repo_package_type` → `$[*].packageType` (Docker, Maven, npm, etc.) - `repo_url` → `$[*].url` (for remote repositories) In your FlutterFlow screen, add a ListView → Backend Query → API Call → select Artifactory / GetRepositories. Inside the list item, bind Text widgets to the `repo_key` and `repo_type` JSON Path values. Add a color-coded Tag widget based on `repo_type` (LOCAL = blue, REMOTE = green, VIRTUAL = orange) for quick visual identification. For a more detailed view, add a second API Call `GetStorageInfo` with endpoint `api/storageinfo` — this returns overall storage statistics including fileCount, usedSpace, and per-repository breakdown in a `repositoriesSummaryList` array.

1{
2  "call_name": "GetRepositories",
3  "method": "GET",
4  "endpoint": "api/repositories",
5  "json_paths": [
6    { "name": "repo_key", "path": "$[*].key" },
7    { "name": "repo_type", "path": "$[*].type" },
8    { "name": "repo_package_type", "path": "$[*].packageType" }
9  ]
10}

AQL (Artifactory Query Language) is Artifactory's most powerful search capability — it lets you find artifacts by name, property, date, repository, and more in a single query. However, it has a critical non-standard requirement that breaks most FlutterFlow setups: **AQL must be sent as a POST with `Content-Type: text/plain` and a raw text body — not JSON.** Sending an AQL query wrapped in a JSON object (`{"query": "items.find(...)"}`) returns a 400 'AQL parsing error'. The raw AQL text itself must be the entire POST body. In FlutterFlow, this requires a separate API Call with overriding headers. Inside the Artifactory API Group, click + Add API Call: - **Call Name:** `SearchAQL` - **Method:** POST - **Endpoint:** `api/search/aql` In this API Call's Headers tab (not the Group headers), add a call-level override: - `Content-Type` → `text/plain` This overrides the Group-level `application/json` for this specific call only. In the Body tab, select Raw/Text body type and add a Variable: `aql_query` (type String). Reference it as the entire body content: `[aql_query]`. In the Variables tab, add a default value for testing: ``` items.find({"repo":{"$eq":"docker-local"}}).include("name","repo","created").sort({"$desc":["created"]}).limit(20) ``` In the Response & Test tab, click Test with the default AQL query. A successful response returns a JSON object with a `results` array containing matching artifact objects. Add JSON Paths: - `artifacts` → `$.results` - `artifact_name` → `$.results[*].name` - `artifact_repo` → `$.results[*].repo` - `artifact_created` → `$.results[*].created` Bind the results to a ListView in the same pattern as the repositories call.

1{
2  "call_name": "SearchAQL",
3  "method": "POST",
4  "endpoint": "api/search/aql",
5  "call_level_headers": [
6    {
7      "name": "Content-Type",
8      "value": "text/plain"
9    }
10  ],
11  "body_type": "raw_text",
12  "body": "[aql_query]",
13  "variables": [
14    {
15      "name": "aql_query",
16      "type": "String",
17      "default": "items.find({\"repo\":{\"$eq\":\"docker-local\"}}).include(\"name\",\"repo\",\"created\").sort({\"$desc\":[\"created\"]}).limit(20)"
18    }
19  ],
20  "json_paths": [
21    { "name": "artifacts", "path": "$.results" },
22    { "name": "artifact_name", "path": "$.results[*].name" },
23    { "name": "artifact_repo", "path": "$.results[*].repo" },
24    { "name": "artifact_created", "path": "$.results[*].created" }
25  ]
26}

The final step is making your AQL-powered screens robust to edge cases and validating on a real device. **Defensive null handling for empty AQL results:** When an AQL query returns no matches, the response is `{"results":[],"range":{...}}` — the `results` key exists but is an empty array. However, on certain error conditions (malformed AQL, permission issues), the `results` key may be absent entirely. JSON Path expressions like `$.results[*].name` return null when applied to a missing `results` key, which causes FlutterFlow's ListView binding to throw an error. Fix this in the FlutterFlow UI: wrap the ListView in a Conditional Widget that checks `getJsonField(response, r'$.results') != null` before rendering. When the condition is false, show an empty state message ('No artifacts found') rather than a broken list. For the same reason, JSON Path the `results` key first with `$.results` to get the array, then use that array as the ListView source rather than binding directly to the nested paths. This gives you one null-check point rather than guarding every individual field binding. **Test on a device for self-hosted Artifactory:** If your Artifactory instance is self-hosted and only accessible on the corporate network or VPN, FlutterFlow's web-based Test mode will reach it (since tests run from your browser, which may be on-network). But your published app's users need to be on the same network or VPN when the app runs. Test this on a physical device using the FlutterFlow mobile app or an APK build while connected to the corporate WiFi. If you need help building a more comprehensive Artifactory dashboard or troubleshooting network connectivity, RapidDev builds FlutterFlow integrations like this every week — free scoping call at rapidevelopers.com/contact.