Keep shared credentials server-side
Use a service credential without embedding secrets in frontend code or distributing them to clients.
Daptin
Run Daptin →
External API integrations
Call third-party services through named Daptin actions, keeping credentials and provider-specific request details away from the browser.
Connected products
Import an OpenAPI definition or configure an operation directly. Map action input into the provider request and return the useful result through Daptin.
Use a service credential without embedding secrets in frontend code or distributing them to clients.
Select the OAuth token connected to that user when a provider call must happen on their behalf.
Supported operations include REST, GraphQL over HTTP, unary gRPC, and WebSocket request/response calls.
Expose only the named operation and protect it with Daptin action permissions.
What this removes
Let each signed-in user call a provider with the OAuth token associated with their own account.
Call payments, messaging, search, or internal APIs with an administrator-controlled service credential.
List installed operations and inspect provider-scoped OpenAPI without exposing the full integration record to clients.
Use REST, GraphQL over HTTP, unary gRPC, or short-lived WebSocket request/response where the operation supports it.
Credential handling
Runtime credential selectors remain separate from the provider's input object. Daptin resolves the permitted server-held or per-user credential and maps the named operation into the external request.
External APIs fail independently from the Daptin database. Test timeouts, expired tokens, non-success responses, malformed payloads, and retry behavior instead of presenting the call as transactionally reversible.
Configure and test an integration →