# Bubble Plugins and API Connector: Extending Your App in 2026

> How Bubble plugins, the API Connector and the Data and Workflow APIs work: plan gates per app, token safety, rate limits and the workload each call spends.

_Source: https://professionalstoolkit.com/articles/bubble-plugins-and-api-connector — The Professional's Toolkit · updated November 2026_

---

Bubble (bubble.io) gives an app three ways to reach past its own editor: **plugins** from its marketplace, the **API Connector** for requests your app sends out, and the **Bubble API** (the Data API and the Workflow API) for requests other systems send in. The API Connector works on every plan. Plugin subscriptions and the Bubble API both start at Bubble's Starter plan, which on the Web tab is $32 per month billed annually or $39 per month billed monthly, per app [1]. Every outgoing call, incoming request and server-side plugin action also spends workload units. Start with the connector on Free to build and test; any live app, and so any real traffic, needs Bubble's Starter plan or higher on the right tab, as our [Free plan guide](/articles/is-bubble-free) explains.


**$32 / month** — Bubble's Starter plan (Web), billed annually, per app ($39 billed monthly): the lowest plan with the Data API, Workflow API and plugin subscriptions.



- **7,677** — Plugins on Bubble's marketplace page as of November 2026
- **15,000 / min** — Data and Workflow API requests on Starter (Growth 25,000, Team 35,000)
- **0.1 WU** — Starting workload cost of one outbound API Connector call


## Which way the data flows decides the plan

Bubble's manual sorts integrations by direction. Outgoing requests start inside your app and travel through the API Connector or a plugin. Incoming requests come from another system and land on the Data API, which searches, reads, creates, changes and deletes records, or on the Workflow API, which runs one of your backend workflows on demand. The connector is not part of the Bubble API, even though both are configured near each other. That split drives gating and workload cost, so settle which side a job sits on first.

| Tool | Direction | Lowest plan | Workload per use (Bubble's starting figure) |
|---|---|---|---|
| API Connector | Outgoing | Free | 0.1 WU per call |
| Data API and Workflow API | Incoming | Starter | 0.01 WU per call |
| Server-side plugin action | Runs on Bubble's server | Free (subscription plugins: Starter) | 0.2 WU plus 0.0005 WU per millisecond |
| Bubble MCP (beta) | An outside AI agent edits the app | Every plan | No Bubble AI credits in beta (workflows it triggers still use WU) |

A Free app can wire up the connector, but backend operations that touch outside services, such as API calls, plugin server actions, emails and push notifications, carry limits the manual describes as meant only for testing. Free also cannot expose the Bubble API or hold a plugin subscription. Treat it as a sandbox. Real traffic needs a paid plan on the right tab, and a project that includes a native app belongs on the Mobile or Web & Mobile tab, which costs more than Web for the same plan.

## Finding, paying for and trimming plugins

Bubble's marketplace page listed 7,677 plugins in November 2026, filterable by platform (web or native mobile), price and whether a partner built them. A plugin can add elements, actions, events, API data sources, background services or OAuth sign-in. Bubble maintains its own set, including Stripe, Braintree, Slack, Mixpanel, Segment, Chart.js, the SQL Database Connector and the Bubble App Connector. Community authors supply the rest, and bugs in their plugins go to the author, not to Bubble. Native apps need mobile plugins: third-party web plugins must be rebuilt, and a Mobile filter shows what fits.

Pricing comes in three shapes: free, a one-time license or a subscription. **Plugin subscriptions need a paid app plan** and follow its billing frequency, so an annual plan gets the plugin at its annual rate. The charge appears on the next bill, removing the plugin credits the unused time, and you can later swap to a one-time license [2]. A paid plugin works only while someone pays for it, even inside a template or a copied app. One timing trap: adding a subscription during the 14-day trial of Bubble's Starter plan charges at once for the plugin and a month of the plan.

Plugin code loads on every page, used or not, so each install makes pages heavier. Uninstall what you stopped calling. The Safe preview mode switches off community plugins and custom HTML while Bubble-built ones stay on, which quickly shows whether a bug comes from a plugin. The AI Agent can also install free or already-purchased plugins and prefers Bubble-built or certified ones, as our [Bubble AI guide](/articles/bubble-ai-app-builder) explains.


> 💡 **Keep credentials in their own collection:** Put API keys in a collection using a method such as Private key in header; values marked Private in a None or OAuth2 User-Agent collection are exposed to anyone.


### Writing or selling your own

One plugin can target web, native mobile or both. API calls inside a plugin need no code, while elements and actions need JavaScript for web or React Native for mobile; the mobile plugin editor moved to public beta in September 2026. Selling requires a seller profile and a Stripe account. Bubble keeps 25% of every license payment, and its marketplace policies set seller ranges of $1 to $100 a month for a single-use plugin subscription and $3 to $300 one-time for a single-use plugin. Open-source plugins must be free.

## Connecting an outside service with the API Connector

The connector reaches almost any JSON REST API, with headers, parameters and a body, and each call becomes either a data source or a workflow action. It has had its own tab since March 2026. A typical setup runs in five steps:

1. Create a collection; authentication, shared headers and shared parameters are set once there.
2. Choose the authentication method the provider expects.
3. Add a call with a unique name and mark it as Data or as Action.
4. Initialize the call before using it; a streaming call must receive its full response first, so it initializes more slowly.
5. Add a separate development key if the provider issues one, so testing never touches the live key.

The menu of methods is long: None or self-handled, two private-key options, HTTP Basic Auth, three OAuth2 flows, JSON Web Token and a client-side SSL certificate. **The trap is the collection type.** In one using None or self-handled, or OAuth2 User-Agent Flow, values marked Private are exposed to anyone, logged-out visitors included [3]. Put credentials in a separate collection using something like Private key in header. Keys entered in private fields of a properly authenticated collection are stored encrypted and stay on the server; default values typed in to initialize a call do not, so keep secrets out of them.


> ⚠ **Admin tokens skip privacy rules:** A Bubble admin API token reaches every exposed data type and public workflow while ignoring privacy rules; authenticate as a user when rules must apply.


A few behaviors shape the design. Calls from non-dedicated apps leave from a Bubble server IP shared by every such app, so a third-party rate limit can be shared with strangers; only a public data call with no authentication, headers or private parameters can run from the browser instead. Responses stop at 50 MB. Long-running calls are retried automatically, which can duplicate actions such as an extra email. For language models, the Stream data type shows replies word by word.

## Opening your app to other systems

Both APIs stay off until you tick them in Settings → API, and the Data API exposes only the data types you check. Records live at `/api/1.1/obj/typename` and workflows at `/api/1.1/wf/workflow_name`, on the bubbleapps.io address or a connected domain, with `version-test` in the path for development and no prefix for Live. Searches page through a cursor, 100 items per request by default, and Bubble can generate a Swagger file describing the endpoints.

Requests authenticate with a bearer token in the Authorization header, and the choice of token changes everything. An admin token, a 32-character string generated in Settings → API, reaches every exposed type and public workflow and **ignores privacy rules**. A request made as a signed-in user has privacy rules applied. With no authentication at all, anyone who knows the endpoint can change every exposed type. Never ship unauthenticated write access.


> 💡 **Issue one admin token per system:** Bubble suggests a separate admin API token for each external system, so you can revoke one without breaking the others.


A workflow becomes reachable only after you tick Expose as public API workflow; it then accepts anyone, any authenticated caller or admin tokens only, and authentication is required by default. POST is the default method, GET is there for services that demand it, and posting a sample to the `/initialize` endpoint lets Bubble detect parameters, which suits webhooks such as a Stripe payment notice. Throughput tops out at 15,000 requests per minute on Starter, 25,000 on Growth and 35,000 on Team [4].

## What integrations cost in workload units

Bubble meters running apps in workload units (WU), counted per app per calendar month: 50K on Free, 175K on Starter, 250K on Growth and 500K on Team. The manual's starting costs are 0.1 WU for an outbound API call, 0.01 WU for an inbound Data or Workflow API call, 0.6 WU for a server-side workflow action and 0.2 WU plus 0.0005 WU per millisecond for a server-side plugin action. These are floors. One visible action can trigger several billed operations, and unauthenticated public endpoints bill you for every stranger's hit.

Server logs show what each action cost. Past the monthly allowance a paid app pays overages at $0.30 per 1K WU (on by default) or buys a workload tier, and with overages switched off it goes offline at the limit until overages are re-enabled, a tier is bought or the next billing period starts; our [Bubble pricing guide](/articles/bubble-pricing) lays out the tiers. Workload and Bubble AI credits are separate allowances, and neither converts into the other.



> ⚠ **Open endpoints spend your workload:** A public API workflow set to run without authentication can be triggered by anyone with the URL, and every hit is billed in workload units.

## Outside AI agents, and the plugin lesson from October 2026

The Bubble MCP, in beta since October 2026, lets Claude, Claude Code, ChatGPT, Codex or GitHub Copilot in VS Code build on a Bubble app as regular elements, workflows and data types. A connected agent can read live app data, trigger existing backend workflows and create new ones and API calls; at launch it could not read logs, merge branches or deploy. It runs on every plan, uses no Bubble AI credits in beta (your AI provider's plan pays), and is approved through OAuth you can revoke.

Plugin authors, note: Bubble's preliminary root-cause analysis (November 2026) says an attacker in October 2026 got partial access to Bubble's production systems and some user data, including private plugin data such as credentials plugin developers had saved, and that developers were emailed the same day to change them. It also targeted individual apps through platform issues that reached stored credentials or data even in correctly set-up apps, and through settings such as privacy rules that granted access; affected owners were contacted. Bubble advises running the security dashboard, reviewing privacy rules, marking API keys private and checking API Connector calls. A final RCA will follow. Treat any secret stored in a plugin as something you may need to rotate.


## FAQ

**Can a Bubble app call OpenAI or another AI model?**

Yes, through a plugin or the API Connector, with streaming replies; the AI provider bills you separately. Bubble had no native action for calling language models as of October 2026 and lists one as planned with no timeline.

**Can Bubble connect to an outside SQL database?**

Yes. Bubble's optional SQL Database Connector plugin links PostgreSQL, MySQL and Microsoft SQL databases and runs queries as actions or data sources; the manual's starting cost is 0.1 WU per call plus 0.015 WU per row returned.

**Can one Bubble app use another Bubble app's data?**

Yes, with the Bubble App Connector plugin, installed only in the app that starts the connection. With an API key it runs as admin in the second app; with OAuth it runs as the signed-in user and privacy rules apply.

**Does Bubble's Zapier plugin work on every hosting setup?**

No. Bubble's manual says the Zapier plugin does not work with apps on dedicated servers (Enterprise), where it recommends webhooks and API connections instead. Each data type used with it must also be enabled in the Data API, which needs Bubble's Starter plan or higher.


## The bottom line

Bubble's integration story starts free: the API Connector runs on every plan, handles OAuth2, JWT and key authentication, and keeps keys on the server when you file them in the right collection. Building and testing integrations is free; going live, opening the Bubble API to outsiders or paying for a plugin subscription all start at Bubble's Starter plan, $32 per month billed annually or $39 billed monthly on the Web tab, per app. Budget workload for every call in either direction, guard admin tokens like passwords, and keep the plugin list short. Remember that Bubble apps run only on Bubble: you can export data and rebuild elsewhere, not take the code, as our [Bubble review](/articles/bubble-review) explains.



## Sources

[1] Bubble Pricing — Start Free, Scale as You Grow — https://bubble.io/pricing (2026-11)
[2] Bubble Manual: Installing and using Plugins — https://manual.bubble.io/help-guides/integrations/using-plugins/installing-and-using-plugins (2026-11)
[3] Bubble Manual: Authentication — https://manual.bubble.io/help-guides/integrations/api/the-api-connector/authentication (2026-11)
[4] Bubble Manual: Hard limits — https://manual.bubble.io/help-guides/maintaining-an-application/performance-and-scaling/hard-limits (2026-11)
[5] Bubble Terms of Service — https://bubble.io/terms
[6] Bubble Privacy Policy — https://bubble.io/privacy