Docs · Sources
Authentication and variables
Most APIs need a key or a token. Choose how the source expects it under Authentication. Secrets are encrypted, never shown again and bound to the host you entered them for.
Authentication types
| Authentication | When to use it |
|---|---|
| Bearer token | The API documentation says Authorization: Bearer YOUR_TOKEN. |
| API key in header | A key in a header such as X-API-Key; set the Header name. |
| API key in URL parameter | A key in the query string such as ?apikey=…; set the Parameter name. |
| Username and password (Basic) | Basic authentication, for example WordPress application passwords. |
| Custom OAuth 2 | Your own OAuth client. Set it up once in Settings, then choose the OAuth 2 connection. |
| OAuth 1.0a | APIs that sign requests with consumer and token secrets. |
| AWS Signature V4 | Amazon S3 objects and other AWS endpoints. |
| Existing Airtable connection | Reading from another Airtable base. |
If you change the source host or the authentication type, Rowvela asks for the secret again, so a saved key cannot be sent to a different server. Never put a key directly into the URL; use the API key field instead.
OAuth 2 connections
- Register an OAuth app at the provider with the callback URL Rowvela shows in Settings → OAuth 2 connections (it ends with
/api/oauth2/callback). Client-credentials apps need no callback. - Add the connection with its authorization URL, token URL, API base URL, client ID, client secret and scopes.
- Select connect, sign in at the provider, and choose the connection in the import. Rowvela refreshes the access token on its own.
Workspace variables
In Settings → Workspace variables, define values like api_base or region once and use them as {{api_base}} in URLs, headers and bodies of every import. Select Add variable; turn on Secret value for keys and passwords, which are then stored encrypted and never shown again.