Lovable, Bolt, Zapier and Make
Use server actions or a backend webhook step so your secret key never enters a public page.
Lovable, Bolt and AI app builders
Add METAPHRASE_API_KEY to the platform's server secrets or backend/edge-function environment. Do not use a frontend/Vite/public variable. Ask the assistant:
Integrate the MetaPhrase paraphrase API into my app. Read https://metaphrase.msalman.com/llms-full.txt first. The secret is in server env var METAPHRASE_API_KEY. Create a server/edge proxy that accepts text, calls POST https://metaphrase.msalman.com/api/v1/paraphrase with Authorization: Bearer from that environment variable and application/json, and returns the full JSON envelope. The frontend calls only my proxy and reads result.text. Validate text length, use my app's login and rate controls, handle error.code/message/docs_url and Retry-After, and never expose or log the secret. Do not invent request fields.
The expected upstream body is:
{"text":"Good writing helps people understand an idea.","mode":"standard","synonym_strength":50,"stream":false}
The server reads the API key from its secret store. The frontend displays response.result.text; it must not assume the response is just a string. The Next.js and plain HTML proxy show working implementations you can adapt to the platform's backend.
Zapier
- Choose your trigger, for example a form submission or Webhooks by Zapier → Catch Hook. Treat the incoming hook URL as a private workflow capability.
- Add Webhooks by Zapier → Custom Request with method POST and URL
https://metaphrase.msalman.com/api/v1/paraphrase. - Set
Content-Typetoapplication/jsonandAuthorizationtoBearerfollowed by your key from a private connection/secret field. Keep it out of public form fields. - Send the JSON body above, mapping the trigger's text into
text. Keepstream:false; ordinary workflow HTTP steps expect one JSON response. - Map the output
result.textinto the next action. Storerequest_idif you need support or traceability. - On 429 honor
Retry-After; onquota_exceededstop or delay until reset rather than looping. See reliability.
Make
Use Webhooks → Custom webhook (or your existing trigger), then HTTP → Make a request. Select POST, use the same endpoint/headers, body type Raw with content type JSON, and enable response parsing. Map the input text into a JSON-escaped string, then read the parsed result.text. Store the Bearer key in a private connection/secret, not an input variable that the browser sends. Configure an error handler for 429/503 with bounded retries and a quota/budget stop condition.
These are incoming automation triggers followed by a synchronous API call. MetaPhrase does not send outgoing completion webhooks. A missing-provider 503 requires the MetaPhrase operator's configuration; changing a no-code mapping will not fix it.
No backend available
Use the embeddable widget instead of putting a secret key into a browser-only API connector. The widget script contains only a public widget ID and can be pasted into a custom HTML component.