Third-party APIs (b77.http)

b77.http.fetch calls a third-party HTTPS API from builder77's servers. Your API keys are stored in Settings → Secrets and written in code as {{secret:NAME}}: the server fills them in, so they never reach the browser.

const res = await b77.http.fetch('https://api.openai.com/v1/chat/completions', {
  method: 'POST',                                          // default GET
  headers: { Authorization: 'Bearer {{secret:OPENAI_API_KEY}}' },
  body: { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'Hi!' }] }, // object → JSON, or a string
});
if (res.ok) console.log(res.data);  // { ok, status, headers, body (text), data (parsed JSON or null) }

Each call uses 1 integration credit. https only, 15-second timeout, responses up to 1 MB. If an API echoes your key back, it is replaced with [secret] before your app sees the response.

Rules for each secret

Anyone using your app can make calls with a secret — without seeing it. So each secret only works the way you allow:

• Allowed hosts — the only servers it is ever sent to (e.g. api.openai.com; *.example.com covers sub-domains).
• Allowed methods — GET and POST by default.
• Allowed paths — optional path prefixes such as /v1/chat/. Empty means any path.
• Where the key may be placed — by default only in a credential header (Authorization, X-Api-Key, Api-Key, X-Goog-Api-Key and similar). Query parameters (by name, e.g. key), the URL path and the request body are off until you turn them on.

A call that breaks a rule is refused with status 403 before anything is sent.

Keys in the URL or body

Prefer APIs that take the key in a header. Some put it in the address instead — allow exactly that spot and narrow the path:

// Settings → Secrets: TELEGRAM_TOKEN, host api.telegram.org, "In the URL path" on,
// allowed path /bot{{secret:TELEGRAM_TOKEN}}/sendMessage
await b77.http.fetch('https://api.telegram.org/bot{{secret:TELEGRAM_TOKEN}}/sendMessage', {
  method: 'POST',
  body: { chat_id: 12345, text: 'New booking!' },
});

Only allow In the request body if the API requires it: anyone using your app could then write the key into anything that API saves (a message, a note, a public file) and read it back.