Moz

Before creating anything in FlutterFlow, you need two credentials from the Moz API dashboard: your Access ID and your Secret Key. Log into your Moz account, navigate to moz.com/api, and generate API credentials if you haven't already. You will see an Access ID (a string starting with 'mozscape-') and a Secret Key (a longer random string). HTTP Basic Auth encodes these as a single string in the format 'AccessID:SecretKey' (with a colon separating them), then base64-encodes that combined string, and sends it as the value of an Authorization header: 'Authorization: Basic [base64value]'. In a web browser you can generate the base64 value by opening the browser console and typing btoa('YOUR_ACCESS_ID:YOUR_SECRET_KEY'). Keep the result — you will use it in the Cloud Function and in testing. The important security point here is that base64 is a reversible encoding, not encryption. Anyone who intercepts or extracts the Authorization header value can immediately decode it back to your raw Access ID and Secret Key with atob() or any base64 decoder. This is why the credentials must stay in a server-side environment — the Cloud Function proxy — rather than being hardcoded in a FlutterFlow API Call header.

1// Generate base64 Basic Auth string (for testing only — do NOT put in FlutterFlow)
2// In a browser console:
3const accessId    = 'YOUR_ACCESS_ID';    // e.g. mozscape-abc123
4const secretKey   = 'YOUR_SECRET_KEY';
5const base64Auth  = btoa(`${accessId}:${secretKey}`);
6console.log('Authorization: Basic ' + base64Auth);
7// Use this value ONLY in your Cloud Function environment variable, not in FlutterFlow

The Cloud Function proxy intercepts FlutterFlow's requests and adds the Moz Basic Auth header server-side. FlutterFlow calls the function URL (which is public and has no secrets in it); the function adds the Authorization header using a stored environment variable, sends the POST to Moz's Links API, and returns the JSON response. Create a Firebase Cloud Function project (or add to an existing one). The function is an HTTP function that accepts POST requests from FlutterFlow. The request body from FlutterFlow contains the targets array. The function reads the base64-encoded credentials from process.env.MOZ_AUTH, constructs the Authorization header, POSTs to https://lsapi.seomoz.com/v2/url_metrics with the correct Content-Type: application/json header, and returns the Moz JSON response. Set the environment variable with: firebase functions:config:set moz.auth='Basic BASE64VALUE' (replace BASE64VALUE with the base64 string from Step 1). Deploy with firebase deploy --only functions. Test the function URL directly by sending a POST with a JSON body: {"targets": ["example.com"]} — you should get back a JSON response with domain_authority and page_authority fields.

1// Firebase Cloud Function proxy for Moz Links API (functions/index.js)
2const functions = require('firebase-functions');
3const axios     = require('axios');
4
5exports.mozProxy = functions.https.onRequest(async (req, res) => {
6  // CORS for FlutterFlow web builds
7  res.set('Access-Control-Allow-Origin', '*');
8  res.set('Access-Control-Allow-Methods', 'POST, OPTIONS');
9  res.set('Access-Control-Allow-Headers', 'Content-Type');
10  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
11  if (req.method !== 'POST') {
12    return res.status(405).json({ error: 'Method not allowed' });
13  }
14
15  const authHeader = process.env.MOZ_AUTH; // e.g. 'Basic BASE64VALUE'
16  const targets    = req.body?.targets;
17
18  if (!targets || !Array.isArray(targets) || targets.length === 0) {
19    return res.status(400).json({ error: 'targets array is required' });
20  }
21
22  try {
23    const response = await axios.post(
24      'https://lsapi.seomoz.com/v2/url_metrics',
25      { targets },
26      {
27        headers: {
28          Authorization: authHeader,
29          'Content-Type': 'application/json'
30        }
31      }
32    );
33    res.json(response.data);
34  } catch (err) {
35    const status = err.response?.status || 500;
36    res.status(status).json({ error: err.message, details: err.response?.data });
37  }
38});

With the proxy running, create the FlutterFlow API Group that points to your Cloud Function. Open FlutterFlow and navigate to API Calls in the left nav. Click + Add → Create API Group. Name it Moz. In the Base URL field, paste your Cloud Function URL: https://us-central1-YOUR_PROJECT.cloudfunctions.net/mozProxy. No Authorization header is needed at the FlutterFlow level since authentication happens inside the Cloud Function. Save the group. Next, click + inside the Moz group → Create API Call. Name it Get URL Metrics. Set the HTTP Method to POST (this is important — it is not a GET). In the Body section, set the Body Type to JSON and enter the body template. Go to the Variables tab and add a variable named targets of type String (you will pass a JSON array string, e.g. '["example.com"]', or build it dynamically in an action). In the Body field, reference the variable: the body should be {"targets": {{targets}}}. Alternatively, if you want to accept a single domain as a string, build the array in the body as {"targets": ["{{target_url}}"]}, with a variable named target_url (String). Switch to Response & Test. Set the target_url test value to example.com and run the test. You should receive a JSON response containing a results array with domain_authority, page_authority, links_in, and root_domains_linking_in fields. Click Generate JSON Paths. Map $.results[0].domain_authority → domainAuthority, $.results[0].page_authority → pageAuthority, and $.results[0].root_domains_linking_in → linkingRootDomains. Save.

1// API Call POST body template (configured in FlutterFlow Body tab)
2{
3  "targets": ["{{target_url}}"]
4}
5
6// JSON Paths to extract from response:
7// domainAuthority    → $.results[0].domain_authority
8// pageAuthority      → $.results[0].page_authority
9// linkingRootDomains → $.results[0].root_domains_linking_in
10// totalExternalLinks → $.results[0].links_in

Now build the visible part of the app: a clean domain authority checker screen where a user enters a URL, taps Check, and sees DA and PA scores returned from Moz. On your main screen, add a TextField widget (hint text: 'Enter a domain or URL') and a Button labeled Check Authority. In the Button's Actions panel, build the following sequence: 1. Validate that the TextField is not empty; if empty, show a Snackbar: 'Please enter a domain or URL'. 2. Set a boolean App State variable isLoading = true (show a CircularProgressIndicator over the button). 3. Backend/API Call → Moz → Get URL Metrics, passing the TextField value as target_url. 4. On success: update a custom Data Type variable (MozResult) in App State with the extracted domainAuthority, pageAuthority, and linkingRootDomains values from the JSON Paths. Set isLoading = false. 5. On error: set isLoading = false and show a Dialog with the error message (e.g. '429 Too Many Requests — Moz rate limit hit'). For the display, add a Row of metric cards below the TextField. Each card has a large bold number (the DA or PA score) and a label below it. Use Conditional Visibility to show the cards only when App State.mozResult is not null. A Color widget can gradient the card background from green (high score) to red (low score) using the DA value for a more visually polished result. Finally, add a small note below the results: 'Data from Moz Links API via mozProxy — refreshed on demand.' This helps users understand the data source and that it doesn't update automatically.

The Moz free tier imposes strict limits — a low monthly request count and a maximum of roughly 10 URL targets per query. As you test, you will quickly exhaust the free quota if you call the API repeatedly. To work within these constraints, implement two safeguards. First, cache results in a Supabase or Firestore collection keyed by domain. Before calling Moz, check the database for a cached DA value with a timestamp within the last 7 days. If found, show the cached value and skip the API call. Only call Moz if the cache is empty or stale. This pattern extends your free-tier quota dramatically for an app that checks a recurring list of domains. Second, add rate-limit handling in your action flow. If the API Call returns a 429 response (Too Many Requests), catch it and show a user-friendly message: 'Moz rate limit reached — please wait a moment and try again.' Do not retry automatically in a loop, as this will continue triggering 429s and draining quota. For mobile testing, FlutterFlow's Run mode (browser) works fine with the proxy. For native app testing, use FlutterFlow's preview on a connected device or export the project and run it locally. The HTTPS call to your Cloud Function URL works identically on iOS, Android, and web.