Security
What a secure Airtable backup workflow should not expose
Keep OAuth tokens, provider file IDs, raw cloud paths, and raw provider errors out of browser-visible pages.
Article status
In this article
Overview
Main point
A secure Airtable backup workflow should show people the state they need while keeping sensitive internals server-side: OAuth tokens, refresh tokens, provider file IDs, raw cloud paths, raw provider errors, Stripe IDs, service-role data, and Airtable record values that do not belong in public support channels.
Backup products handle sensitive context by default. Even when the product is read-focused, the surrounding metadata can reveal too much if it is shown carelessly.
The safest interface is not the one that hides everything. It is the one that shows the right human-facing labels while keeping internal identifiers, secrets, and raw provider details out of the browser.
Tokens
Never expose OAuth tokens or refresh tokens
Airtable, Google Drive, and Dropbox connections should happen through server-side OAuth handling. Tokens belong in encrypted server-side storage, not in browser code or public docs.
Users need to know whether a connection is healthy. They do not need to see the token material that makes it work.
Provider internals
Keep provider file IDs and raw cloud paths server-side
Cloud providers need IDs, paths, and metadata to find files. Humans usually need safe labels: which provider is connected, which folder was selected, and whether the latest snapshot completed.
Showing raw provider details creates unnecessary leakage and makes support conversations riskier.
Errors
Map raw provider errors to safe user messages
Raw provider errors can contain confusing or sensitive context. The browser should receive safe messages such as reconnect cloud storage or Airtable connection needs attention.
Detailed diagnostics belong in server-side handling and carefully scrubbed monitoring, not in a public-facing support screenshot.
Support
Keep Airtable values out of public support channels
Airtable record values can contain customer names, sales notes, project details, or operational data. Public support pages and marketing blog posts should never include raw customer records.
When a support case requires examples, use safe labels and ask for the minimum context needed. Never ask for secrets, OAuth codes, provider IDs, private row IDs, or raw customer data in chat.
FAQ
Questions this article answers
Can browser code ever use the Supabase service role key?
No. Service-role access is server-only. Browser code must never receive service-role data, service-role keys, OAuth tokens, refresh tokens, or provider secrets.
What should a support screenshot show?
A support screenshot should show safe account state, connection state, plan state, or destination labels only. It should not show tokens, raw provider paths, provider IDs, Stripe IDs, or private Airtable values.