Oracle Database

Before FlutterFlow can talk to Oracle, you need a REST interface in front of your database. Oracle REST Data Services (ORDS) is the recommended path because it auto-generates endpoints — you write zero API code. If you're using Oracle Autonomous Database on Oracle Cloud: ORDS is already running. Log into the Oracle Cloud Console at cloud.oracle.com, navigate to your Autonomous Database instance, and click 'Database Actions'. In the Database Actions Launchpad, open 'REST'. From here you can enable REST on specific tables: click 'Modules' then 'AutoREST' to enable automatic REST on any table. Toggle the switch next to your table name and click 'Enable'. This generates endpoints at the pattern `https://{adb-host}/ords/{schema}/{table}/`. If you're on a self-managed Oracle Database: install ORDS (download free from oracle.com/rest-data-services). Connect ORDS to your database using a configuration file where you set the JDBC URL, schema user, and password — these credentials live on the ORDS server and are never exposed to clients. Start the ORDS server on a port you choose (default 8080; put it behind an HTTPS reverse proxy like Nginx for production). Then in SQL*Plus or SQLcl, connect as your schema user and run: `BEGIN ORDS.ENABLE_SCHEMA(p_enabled => TRUE, p_schema => 'YOUR_SCHEMA', p_url_mapping_type => 'BASE_PATH', p_url_mapping_pattern => 'api', p_auto_rest_auth => FALSE); COMMIT; END;` to enable REST on the schema. Individual tables are then accessible at `/ords/api/{table}/`. Test the endpoint in your browser: `https://your-ords-host/ords/your_schema/your_table/`. You should see JSON with an `items` array. If you see a 401, ORDS authentication is enabled — configure OAuth2 in the next step before testing.

Raw ORDS endpoints with no auth are publicly accessible — anyone who knows the URL can read your data. For a production FlutterFlow app, you need to configure ORDS OAuth2 so that only your app can call the endpoints. In Oracle Database Actions (Autonomous Database) or via SQL, run the following to create an OAuth2 client. This creates a client ID and secret that your FlutterFlow app will exchange for a bearer token. The client secret must be stored on your backend or in a secure location — not in FlutterFlow directly. In Database Actions, navigate to REST → Security → OAuth Clients, then click 'New Client'. Set the Name (e.g. 'FlutterFlowClient'), Owner Email, Support URI, and select the 'Client Credentials' grant type. Copy the generated Client ID and Client Secret immediately — the secret won't be shown again. To get a bearer token, your FlutterFlow app will call the ORDS token endpoint: `POST https://{ords-host}/ords/{schema}/oauth/token` with `grant_type=client_credentials` and the client credentials as Basic Auth. This token exchange should happen via a small backend function (see Step 3 note) or you can hard-code a long-lived token for initial testing only. For simpler setups, ORDS also supports HTTP Basic authentication at the ORDS level. In FlutterFlow, this means adding an `Authorization: Basic {base64(user:pass)}` header to your API Call — but be aware this encodes the credentials in the compiled app, which is acceptable only if the ORDS user has limited, read-only permissions and you rotate credentials regularly. For a production app with write access, use OAuth2 bearer tokens from a backend endpoint. If your team already uses a Firebase project with FlutterFlow, the cleanest production path is a Firebase Cloud Function that holds the ORDS client secret, exchanges it for a bearer token, and proxies the ORDS calls — FlutterFlow calls the Firebase Function, the Function calls ORDS. This keeps all Oracle credentials off the client entirely.

1// Firebase Cloud Function proxy (Node.js) — keeps ORDS client secret server-side
2const { onRequest } = require('firebase-functions/v2/https');
3const { defineSecret } = require('firebase-functions/params');
4const fetch = require('node-fetch');
5
6const ORDS_CLIENT_ID = defineSecret('ORDS_CLIENT_ID');
7const ORDS_CLIENT_SECRET = defineSecret('ORDS_CLIENT_SECRET');
8
9exports.queryOracle = onRequest({ secrets: [ORDS_CLIENT_ID, ORDS_CLIENT_SECRET] }, async (req, res) => {
10  res.set('Access-Control-Allow-Origin', '*');
11  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
12
13  // Step 1: Get ORDS bearer token
14  const credentials = Buffer.from(`${ORDS_CLIENT_ID.value()}:${ORDS_CLIENT_SECRET.value()}`).toString('base64');
15  const tokenResp = await fetch('https://your-ords-host/ords/myschema/oauth/token', {
16    method: 'POST',
17    headers: { 'Authorization': `Basic ${credentials}`, 'Content-Type': 'application/x-www-form-urlencoded' },
18    body: 'grant_type=client_credentials'
19  });
20  const { access_token } = await tokenResp.json();
21
22  // Step 2: Call ORDS endpoint
23  const ordsResp = await fetch(`https://your-ords-host/ords/myschema/${req.query.table}/`, {
24    headers: { 'Authorization': `Bearer ${access_token}` }
25  });
26  const data = await ordsResp.json();
27  res.json(data);
28});

Now that ORDS is running and authenticated, you can configure FlutterFlow to call it. Open your FlutterFlow project and click 'API Calls' in the left navigation panel. Click '+ Add' and select 'Create API Group'. This group will hold all of your Oracle-related API calls under a shared base URL. In the 'Group Name' field, enter something descriptive like 'OracleDatabase' or 'ORDSAPI'. In the 'Base URL' field, enter the root of your ORDS instance: `https://your-ords-host/ords/your_schema` — replace the placeholders with your actual host and schema name. If you're using the Firebase Cloud Function proxy from Step 2, enter the Cloud Function URL instead (e.g. `https://us-central1-your-project.cloudfunctions.net`). Next, configure authentication. If you're using a bearer token directly, click on the 'Headers' tab and add a new header: Key = `Authorization`, Value = `Bearer {{token}}`. Click the '+ Add Variable' button in the Variables tab and create a variable named `token` of type String. This variable will be passed dynamically at runtime (from a stored token or an app state variable). If using Basic Auth for a read-only setup, the Value is `Basic {{base64credentials}}` — but prefer the proxy approach for write operations. If your ORDS endpoint is behind a custom domain with HTTPS, FlutterFlow will work without issues on all platforms. If you're still on HTTP during development, note that FlutterFlow web previews will block mixed-content requests — use HTTPS from day one. Click 'Save Group' to proceed. The group now appears in your API Calls panel. You'll add individual endpoint calls inside it in the next step.

1// API Group configuration reference (JSON)
2{
3  "group_name": "OracleDatabase",
4  "base_url": "https://your-ords-host/ords/your_schema",
5  "headers": [
6    {
7      "key": "Authorization",
8      "value": "Bearer {{token}}"
9    },
10    {
11      "key": "Content-Type",
12      "value": "application/json"
13    }
14  ],
15  "variables": [
16    { "name": "token", "type": "String" }
17  ]
18}

Inside the OracleDatabase API Group, you'll now add individual calls for each database operation. Click the group name to expand it, then click '+ Add API Call'. For a List (GET all rows) call: Name it 'ListItems' (replace 'Items' with your table name). Set Method to GET. Set the endpoint path to `/your_table/` — ORDS appends this to the base URL. In the Variables tab, add an optional variable `q` (type String) for ORDS filtering, which you'd append as a query parameter: endpoint becomes `/your_table/?q={{q}}`. Under the 'Response & Test' tab, click 'Test API Call'. If your base URL, headers, and auth are correct, you'll see the raw JSON response. Click 'Generate from Response' to auto-generate JSON Paths from the response structure. This is where the ORDS envelope matters critically: ORDS wraps all results in a top-level object with two keys: `items` (an array of your row objects) and pagination fields like `hasMore`, `limit`, `offset`, and `links`. Your JSON Paths to extract data must start with `$.items[*].column_name`. For example, to extract a column called `PRODUCT_NAME`, the JSON path is `$.items[*].PRODUCT_NAME`. Note that Oracle column names are typically uppercase — your JSON paths must match exactly. For an Insert (POST) call: Name it 'CreateItem'. Set Method to POST. Endpoint: `/your_table/`. In the Body tab, set type to JSON and add variables for each column you want to insert: `{ "COLUMN_NAME": "{{value}}" }`. ORDS accepts this format and inserts the row, returning the inserted record. For an Update (PUT) call: Name it 'UpdateItem'. Set Method to PUT. Endpoint: `/your_table/{{row_id}}` — ORDS uses the primary key in the URL path. Body: same JSON format with the updated values. For a Delete (DELETE) call: Name it 'DeleteItem'. Method DELETE. Endpoint: `/your_table/{{row_id}}`. Save each call after testing it. The test tab will show you the exact response shape so you can finalize your JSON paths before binding to widgets.

1// ORDS API Call configurations
2
3// GET /products/ — list with optional filter
4// Endpoint: /products/?q={"CATEGORY":{"$eq":"{{category}}"}}
5// ORDS filter uses JSON query syntax
6
7// Response envelope (all ORDS list endpoints):
8// {
9//   "items": [
10//     { "PRODUCT_ID": 1, "PRODUCT_NAME": "Widget", "PRICE": 9.99 },
11//     { "PRODUCT_ID": 2, "PRODUCT_NAME": "Gadget", "PRICE": 24.99 }
12//   ],
13//   "hasMore": false,
14//   "limit": 25,
15//   "offset": 0,
16//   "count": 2,
17//   "links": [...]
18// }
19
20// JSON Paths to map response to FlutterFlow Data Type:
21// Product ID:   $.items[*].PRODUCT_ID
22// Product Name: $.items[*].PRODUCT_NAME
23// Price:        $.items[*].PRICE
24
25// POST /products/ — insert new row
26// Body: { "PRODUCT_NAME": "{{name}}", "PRICE": {{price}}, "CATEGORY": "{{category}}" }
27
28// PUT /products/{{product_id}} — update row by primary key
29// Body: { "PRODUCT_NAME": "{{name}}", "PRICE": {{price}} }
30
31// DELETE /products/{{product_id}} — delete row by primary key

Now that your API Calls are configured and tested, you need to map the response data to FlutterFlow Data Types so widgets can display it typed and structured. In the left nav, click 'Data Types' (the grid icon). Click '+ Add Data Type' and name it to match your Oracle table, e.g. 'Product'. Add a field for each Oracle column you want to display: click '+ Add Field', enter the field name (matching your ORDS JSON key, e.g. PRODUCT_NAME), and set the type (String, Integer, Double, etc.). Save the Data Type. Now go back to your API Call (API Calls → OracleDatabase → ListItems). In the 'Response & Test' tab, look at the JSON Paths section. Map each path to your Data Type fields: click the path for `$.items[*].PRODUCT_NAME`, select the 'Product' Data Type, and select the 'PRODUCT_NAME' field. Repeat for each column. FlutterFlow will now know that this API Call returns a list of Product objects. On a page in your app, add a 'ListView' widget. In the widget's properties panel on the right, look for 'Backend Query'. Click '+ Add Query', select 'API Call', and choose your 'ListItems' call from the OracleDatabase group. If the call needs an auth token, you'll need to pass it here — either from an App State variable where you stored it after login, or from a Secure Storage value via Custom Action. The ListView now has access to the list of Products from the API response. Add a child 'Container' widget inside the ListView, then add Text widgets inside it. Bind each Text widget's value to a Product field: click the Text widget → Value → Backend Data → select your API call → select the field (e.g. PRODUCT_NAME). Repeat for price, category, etc. For create/update forms, use FlutterFlow's 'Form' widget or individual TextFields. On button press, open the Action Flow Editor and add an 'API Call' action pointing to your CreateItem or UpdateItem call, mapping form field values to API variables.

One of Oracle's most powerful ORDS features is the ability to expose PL/SQL stored procedures and functions as REST endpoints — callable from FlutterFlow just like any other API Call. This lets your existing business logic (validation, complex calculations, multi-table transactions) run server-side in Oracle, called from a mobile app with no additional backend needed. To expose a PL/SQL procedure via ORDS, in SQL Developer or Database Actions SQL Worksheet, run: ```sql BEGIN ORDS.DEFINE_SERVICE( p_module_name => 'inventory', p_base_path => '/inventory/', p_pattern => 'adjust-stock/', p_method => 'POST', p_source_type => ORDS.source_type_plsql, p_source => 'BEGIN adjust_stock(:product_id, :quantity_delta); END;', p_access_control_check => TRUE ); COMMIT; END; ``` This makes `POST /ords/your_schema/inventory/adjust-stock/` callable from FlutterFlow, where the body can pass `product_id` and `quantity_delta` as JSON parameters that bind to PL/SQL parameters. In FlutterFlow, add a new API Call inside your OracleDatabase group: Name = 'AdjustStock', Method = POST, Endpoint = `/inventory/adjust-stock/`, Body = `{ "product_id": {{product_id}}, "quantity_delta": {{delta}} }`, with variables `product_id` (Integer) and `delta` (Integer). Bind this call to a stepper widget's increment/decrement button in your app. For Oracle Autonomous Database testing: the Autonomous Database wallet (cwallet.sso or tnsnames.ora files) is configured on the ORDS host at the JDBC URL level — you never interact with it from FlutterFlow. Test the full integration using FlutterFlow's 'Test Mode' first (which runs in a browser), then run a full device test via 'Local Run' on an iOS Simulator or Android Emulator to verify behavior on native. If you encounter 401 errors, your bearer token may have expired — add token refresh logic in your Cloud Function proxy.

1-- Enable ORDS on a PL/SQL stored procedure (run in SQL Developer / Database Actions)
2BEGIN
3  ORDS.DEFINE_MODULE(
4    p_module_name    => 'inventory',
5    p_base_path      => '/inventory/',
6    p_items_per_page => 25
7  );
8
9  ORDS.DEFINE_TEMPLATE(
10    p_module_name    => 'inventory',
11    p_pattern        => 'adjust-stock/'
12  );
13
14  ORDS.DEFINE_HANDLER(
15    p_module_name    => 'inventory',
16    p_pattern        => 'adjust-stock/',
17    p_method         => 'POST',
18    p_source_type    => ORDS.source_type_plsql,
19    p_source         => '
20      DECLARE
21        v_product_id NUMBER := :product_id;
22        v_quantity   NUMBER := :quantity_delta;
23      BEGIN
24        UPDATE inventory
25           SET quantity_on_hand = quantity_on_hand + v_quantity
26         WHERE product_id = v_product_id;
27        COMMIT;
28        :status_code := 200;
29      END;
30    '
31  );
32
33  COMMIT;
34END;
35/