# How do you make your online database secure?
**URL:** https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505
**Category:** Questions about Thunkable X
**Tags:** database
**Created:** [August 3, 2020, 9:21pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505 "2020-08-03T21:21:38Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@maxb](https://community.thunkable.com/u/maxb)
#### Post date: [August 3, 2020, 9:21pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/1 "2020-08-03T21:21:39Z")
How should I set the API key, secret code and similar in the app?
In the specific design section of the component?
In the blocks section?
If it’s written in the app’s code, can’t an hacker find it by opening and looking at the apk’s code?
---
### Author:  [@actech](https://community.thunkable.com/u/actech)
#### Post date: [August 4, 2020, 10:23am UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/2 "2020-08-04T10:23:21Z")
Hi, this issue has already been discussed more than once. You can’t save the API key in the app so that it can’t be retrieved. But you can make it more difficult to get it if you store it in encrypted form and decrypt it before using it. But here there is a second question that goes beyond the scope of this forum - and whether the hacker will be able to get the key at the time of sending it to the server?
---
### Author:  [@maxb](https://community.thunkable.com/u/maxb)
#### Post date: [August 6, 2020, 7:54pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/3 "2020-08-06T19:54:32Z")
wow, so our online databases are potentially completely vulnerable and am hacker could just find the keyand access it and change anything he wants?
How do I encrypt it? (But i feel that intercepting thesignalgoing to the server is not hard so it’s pointless, right?)
---
### Author:  [@eoinparkinson](https://community.thunkable.com/u/eoinparkinson)
#### Post date: [August 6, 2020, 8:08pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/4 "2020-08-06T20:08:08Z")
@maxb with Firebase, you can create security rules. The device accessing Firebase requires the endpoint url **and** apiKey, so in theory this is public information. See [this](https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public) post.
As far as Airtable goes, @actech’s suggestion of encryption makes sense. I’ve never looked into Airtable security and don’t know much about it.
My theory may be incorrect on this one, but you could use a public endpoint and re-direct requests to the private endpoint. That way you hide your keys and url. An intruder could still delete data from your database, but only through your public api, which would be set as the only allowed ip.
Either way, it is best practice to have security rules in place.
---
### Author:  [@maxb](https://community.thunkable.com/u/maxb)
#### Post date: [August 6, 2020, 8:11pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/5 "2020-08-06T20:11:04Z")
I know about firebase but im using cloudinary and airtable, if they are not hacker proof how can we create any serious app?
I thought of that “2 factors passage”, I thought of a site that stores the secret keys and has an automation that redirects what you send towards it, but I don’t know how to programsucha site, is it possibile?
---
### Author:  [@eoinparkinson](https://community.thunkable.com/u/eoinparkinson)
#### Post date: [August 6, 2020, 8:17pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/6 "2020-08-06T20:17:12Z")
# Airtable
> **[Can I use the Airtable API securely from the browser?](https://community.airtable.com/t/can-i-use-the-airtable-api-securely-from-the-browser/28810/2)**
>
> Indeed, this is a true statement, so you should never publish your API key into public-facing pages on the interwebs. One approach (and there are many) is to embed the API key into a server-side resource that is protected from direct and open...
This _seems_ on par with the solution I stated previously.
# Cloudinary
Can’t seem to find a lot on this (I don’t use Cloudinary), but my guess is to utilize the same solution, or check if there is an option to only publish new images to Cloudinary, and not to delete them.
---
### Author:  [@maxb](https://community.thunkable.com/u/maxb)
#### Post date: [August 6, 2020, 8:19pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/7 "2020-08-06T20:19:00Z")
Ijust edited my last answer go check it if you want, do you upload images somewhere else or you just don’t upload them?
---
### Author:  [@eoinparkinson](https://community.thunkable.com/u/eoinparkinson)
#### Post date: [August 6, 2020, 8:20pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/8 "2020-08-06T20:20:18Z")
> [@maxb](#):
>
> I thought of that “2 factors passage”, I thought of a site that stores the secret keys and has an automation that redirects what you send towards it, but I don’t know how to programsucha site, is it possibile?
You could create such an application using [Python](http://python.org) and host it for free on [Heroku](http://heroku.com). Python being my recommendation because it’s easy to learn, has lots of Stack Overflow topics on it & works with Heroku.
There may be no-code solutions out there, again I have no idea of something like [Integromat](http://integromat.com) or [Zapier](http://zapier.com) could achieve this.
---
### Author:  [@maxb](https://community.thunkable.com/u/maxb)
#### Post date: [August 6, 2020, 8:24pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/9 "2020-08-06T20:24:59Z")
Ok thx, maybe I’ll check it but there is so many things to learn, it was easier to directly learn java and program directly on android!
---
### Author:  [@ioannis](https://community.thunkable.com/u/ioannis)
#### Post date: [November 8, 2024, 12:26pm UTC](https://community.thunkable.com/t/how-do-you-make-your-online-database-secure/718505/10 "2024-11-08T12:26:45Z")