Bubble
DEVELOPER · DEVELOPER
Create, read, change, and delete the things in their own Bubble app’s database.
Connect Bubble with Fabriq Developer
Your user pastes their Bubble credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting Bubble in practice
Bubble’s Data API is off until the app owner ticks "This app exposes a Data API" in Settings - API and then exposes each data type one at a time, and after that the privacy rules plus separate "Create via API", "Modify via API" and "Delete via API" switches decide what a token can touch — so a technically valid token can see an app that looks empty.
Scopes that draw scrutiny
Admin authentication (API token)Bubble defines access by authentication mode rather than scopes. An admin API token bypasses the privacy rules that constrain user-authenticated calls, so it is the credential that sees everything.Create via API / Modify via API / Delete via APIThese are per-data-type privacy-rule options, not scope tokens. Write access is granted by ticking them on the data type, independently of whether the same rule allows reading it.
Rate limits
- A GET request is limited to 50,000 items; "For the Enterprise plan the limit is 10,000,000 items".
- Pagination uses cursor and limit, and responses report cursor (the rank of the first item), count (items in this response) and remaining (records left).
Who has to approve
The app’s own owner is the gate rather than a tenant admin: "The Data API is disabled by default. To enable it, go to Settings - API and check the box ‘This app exposes a Data API’", and then each data type is exposed individually. Nothing an agent does can turn it on.
Worth knowing
- Read access and API write access are separate decisions on the same data type, so an agent can list records it cannot modify and get no scope-shaped error explaining why.
- Because privacy rules filter records and fields rather than rejecting the call, a misconfigured rule produces a successful, thinner response — which is much harder to notice than a 403.
- The 50,000-item ceiling is per GET request, not per page, so a bulk export of a large table has to be split by filter as well as by cursor.
- Exposure is per data type, so adding a new type to the app does not add it to the API and the integration quietly stops covering new data.
Checked against The Data API (2026-09-29), Data API requests (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Bubble behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.