SpyFu

A decompiled Flutter APK or IPA exposes every value in API Call query variables, including your SpyFu API key. Since SpyFu keys gate access to a paid plan's competitor intelligence data, an exposed key lets anyone drain your request quota. The Firebase Cloud Function proxy prevents this: FlutterFlow calls the proxy with only the domain and endpoint type as parameters; the proxy appends the secret API key before forwarding to SpyFu and returns clean JSON to the app. Create an HTTP Cloud Function. The function receives the target domain, the SpyFu endpoint type (e.g. 'organic_keywords', 'paid_keywords', 'serp'), and optional parameters (countryCode, page) as query parameters from FlutterFlow. It reads the API key from process.env.SPYFU_KEY, maps the endpoint type to the correct SpyFu URL path, appends all parameters including the key, and returns the SpyFu JSON response to FlutterFlow. Set the key: firebase functions:config:set spyfu.key='YOUR_KEY'. Add CORS headers for FlutterFlow web compatibility. Deploy with firebase deploy --only functions. Test by calling the function URL directly with ?domain=example.com&type=organic_keywords and confirming the SpyFu JSON response with a 'results' array.

1// Firebase Cloud Function proxy for SpyFu (functions/index.js)
2const functions = require('firebase-functions');
3const axios     = require('axios');
4
5// SpyFu endpoint families and their paths
6const ENDPOINTS = {
7  organic_keywords: '/domain_api/v2/organic_keywords/by_count?',
8  paid_keywords:    '/domain_api/v2/paid_keywords/by_count?',
9  domain_stats:     '/domain_api/v2/domain_stats/by_domain?',
10  serp_results:     '/serp_api/v2/results?'
11};
12
13exports.spyfuProxy = functions.https.onRequest(async (req, res) => {
14  res.set('Access-Control-Allow-Origin', '*');
15  res.set('Access-Control-Allow-Methods', 'GET, OPTIONS');
16  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
17
18  const key         = process.env.SPYFU_KEY;
19  const type        = req.query.type        || 'organic_keywords';
20  const domain      = req.query.domain      || '';
21  const keyword     = req.query.keyword     || '';
22  const countryCode = req.query.countryCode || 'US';
23  const pageNum     = req.query.pageNum     || '1';
24  const count       = req.query.count       || '10';
25
26  const endpointPath = ENDPOINTS[type];
27  if (!endpointPath) {
28    return res.status(400).json({ error: 'Invalid endpoint type' });
29  }
30
31  const domainOrKw = type === 'serp_results' ? `keyword=${encodeURIComponent(keyword)}` : `domain=${encodeURIComponent(domain)}`;
32  const url = `https://www.spyfu.com/apis${endpointPath}${domainOrKw}&countryCode=${countryCode}&pageNum=${pageNum}&count=${count}&api_key=${key}`;
33
34  try {
35    const response = await axios.get(url, { timeout: 15000 });
36    res.json(response.data);
37  } catch (err) {
38    const status = err.response?.status || 500;
39    res.status(status).json({ error: err.message });
40  }
41});

Open FlutterFlow and navigate to API Calls in the left nav. Click + Add → Create API Group. Name it SpyFu. In the Base URL field, paste your Cloud Function URL: https://us-central1-YOUR_PROJECT.cloudfunctions.net/spyfuProxy. No Authorization header is needed at the group level — the proxy handles authentication internally. Save the group. Because SpyFu has two distinct API families (domain_api and serp_api), you will create two separate API Calls inside this group: one for domain intelligence (organic and paid keywords for a given domain) and one for SERP keyword data. Both point to the same proxy base URL but pass different 'type' parameters, which the proxy maps to the correct SpyFu path. Saving the group makes it available in the left nav API Calls panel. Note the group name — you will reference it when setting up button actions in later steps.

Inside the SpyFu group, you will create two API Calls: one for organic keyword data and one for paid keyword data. Both are GET requests that pass the same parameters with different 'type' values. Click + inside the SpyFu group → Create API Call. Name it Get Organic Keywords. Set the method to GET. Go to the Variables tab and add: - domain (String, required) — the competitor domain to analyze, e.g. competitor.com - countryCode (String, default: US) — US, UK, DE, AU, etc. - pageNum (Integer, default: 1) — pagination - count (Integer, default: 10) — results per page In the URL field, reference them: /?type=organic_keywords&domain={{domain}}&countryCode={{countryCode}}&pageNum={{pageNum}}&count={{count}} Switch to Response & Test. Enter a competitor domain and run the test. SpyFu returns a JSON object with a 'results' array where each item has: keyword, avgMonthlyClicks, rankingDifficulty, searchVolume, monthlyBudget. Click Generate JSON Paths. Extract: $.results[*].keyword → keywords, $.results[*].avgMonthlyClicks → clicks, $.results[*].searchVolume → volumes. Repeat to create a second API Call named Get Paid Keywords, with type=paid_keywords. The response structure is similar with additional fields like adBudget and adCount. Also add a third API Call Get Domain Stats using type=domain_stats which returns aggregate metrics (organicKeywords, paidKeywords, adBudget) for the competitor domain as a single object.

1// API Call URL patterns (set in FlutterFlow Variables tab)
2// Organic keywords:
3// /?type=organic_keywords&domain={{domain}}&countryCode={{countryCode}}&pageNum={{pageNum}}&count={{count}}
4//
5// Paid keywords:
6// /?type=paid_keywords&domain={{domain}}&countryCode={{countryCode}}&pageNum={{pageNum}}&count={{count}}
7//
8// Domain stats:
9// /?type=domain_stats&domain={{domain}}&countryCode={{countryCode}}
10//
11// SERP results (keyword search, not domain):
12// /?type=serp_results&keyword={{keyword}}&countryCode={{countryCode}}&pageNum={{pageNum}}&count={{count}}
13
14// JSON Paths for organic_keywords response:
15// $.results[*].keyword           — keyword string list
16// $.results[*].avgMonthlyClicks  — estimated monthly clicks list
17// $.results[*].searchVolume      — monthly search volume list
18// $.results[*].rankingDifficulty — difficulty score list (0-100)
19
20// JSON Paths for domain_stats response:
21// $.results[0].organicKeywords  — total organic keyword count
22// $.results[0].paidKeywords     — total paid keyword count
23// $.results[0].adBudget         — estimated monthly ad budget

The core UX for a SpyFu integration is a 'search a domain' pattern: one TextField where the user enters a competitor domain, a Search button, and a tabbed results view showing organic keywords and paid keywords as separate ListViews. On your main screen, add a TextField (hint: 'Enter competitor domain, e.g. competitor.com') and a large Search button below it. Add a TabBar with two tabs: 'Organic' and 'Paid'. Each tab contains a ListView for the corresponding keyword data. In the Search button's Actions panel: 1. Validate the TextField is not empty. If empty, show Snackbar: 'Please enter a competitor domain'. 2. Set isLoading = true (show CircularProgressIndicator, disable Search button). 3. Run three parallel actions: Get Organic Keywords, Get Paid Keywords, and Get Domain Stats API Calls, all with the TextField value as domain. 4. On all three succeeding: store the organic keyword list, paid keyword list, and domain stats in App State variables. Set isLoading = false. 5. On any error: show a Dialog with the error message and set isLoading = false. The Organic tab ListView uses the organic keywords App State list as its data source, with each item tile showing keyword name (bold), monthly search volume, and estimated monthly clicks. The Paid tab ListView mirrors this structure for paid keywords, adding the estimated ad budget as an additional chip. At the top of the results area (above the TabBar), add a Domain Stats card showing the competitor's total organic keyword count and estimated paid ad budget from the Get Domain Stats response — giving an instant overview before the user digs into the lists.

SpyFu rate limits scale with plan tier. On a lower plan, a quick repeated tapping of Search, or a ListView that re-fetches on scroll instead of loading from App State, can hit the cap and return 429 errors. Guard against this with two patterns. First, store the domain searched last (App State variable: lastSpyfuDomain) and the timestamp. When the user searches the same domain again within 10 minutes, show the cached App State data rather than re-calling the API. This covers the common pattern of browsing between tabs and returning to the same competitor. Second, implement pagination for keyword lists. SpyFu's results are paginated (pageNum, count parameters). Add a 'Load more' button at the bottom of each ListView. When tapped, it calls the same API Call with pageNum incremented by 1 and appends the new results to the existing App State list rather than replacing it. This avoids loading all 50+ keywords at once, which can exceed plan limits on a single call. For device testing, FlutterFlow's browser Run mode works fine since the Cloud Function handles CORS. Export to a test APK or use FlutterFlow's Preview on a connected device to confirm the full flow on mobile. No platform-specific permissions (camera, location, HealthKit) are needed for this integration — it is purely HTTP-based. If you'd rather skip the proxy setup and have a FlutterFlow expert wire the full SpyFu integration for you, RapidDev's team builds integrations like this every week — free scoping call at rapidevelopers.com/contact.