HTTP / REST API

What it is

The HTTP integration connects to any API that Honeybase has no dedicated integration for. You give it a base URL and tell it how the API authenticates, and request nodes then call paths under that base URL without repeating the credential.

Six authentication options are supported, from none at all to a signed JWT.

Before you start

Have the API's documentation open, specifically its authentication section. The vocabulary differs between providers — "API key" may mean a header, a query parameter, Basic auth with a fixed username, or an OAuth client secret — and choosing the wrong option here is the most common reason a connection fails to test.

Setup fields

These are the fields the guided setup collects — both the Add integration form and the setup card Barry raises in chat. Additional settings live on the connection's settings page once it exists.

Connection settings

Field	Type	Required	Secret	Notes
name	Text	Yes	No	Display name for this connection. This is what you pick from in a workflow node.
baseUrl	Text	Yes	No	The API's base URL. Request nodes append a path to it, so a change of environment is one edit here rather than one per node.
timeoutMs	Number	No	No	How long to wait for a response, in milliseconds, before the request fails. Optional.

Credentials

This integration has 6 credential options. You supply the fields for the one you pick.

No authentication

For public APIs, and for APIs whose credential travels in a header or query parameter you set on the connection instead.

No credential fields are collected for this option in the guided setup.

HTTP Basic

Username and password, sent in an Authorization: Basic header.

Field	Type	Required	Secret	Notes
auth.username	Text	Yes	No	The username for HTTP Basic authentication.
auth.password	Password	Yes	Yes	The password for HTTP Basic authentication. Many APIs expect a token here with a fixed or empty username — check their docs.

OAuth 2.0 client credentials

Machine-to-machine OAuth. Honeybase exchanges the client ID and secret for an access token and refreshes it as needed — no person is involved.

Field	Type	Required	Secret	Notes
auth.tokenUrl	Text	Yes	No	The token endpoint to exchange credentials at, from the API's OAuth documentation.
auth.clientId	Text	Yes	No	The client ID the API issued when you registered an application with it.
auth.clientSecret	Password	Yes	Yes	The client secret issued alongside that client ID.
auth.scopes	Text	No	No	Space-separated scopes to request. Ask for the narrowest set the workflow needs. Optional.
auth.audience	Text	No	No	The audience or resource identifier, if the provider requires one — Auth0 and some enterprise gateways do. Optional.
auth.clientAuthInBody	Toggle	No	No	Send the client ID and secret in the request body instead of the Authorization header. Some token endpoints only accept one or the other. Optional.

OAuth 2.0 authorization code

OAuth where a person approves access in a browser. Use it when the API acts on behalf of a user rather than the organization.

Field	Type	Required	Secret	Notes
auth.authorizationUrl	Text	Yes	No	The endpoint a person is sent to in order to approve access. Authorization-code flow only.
auth.tokenUrl	Text	Yes	No	The token endpoint to exchange credentials at, from the API's OAuth documentation.
auth.clientId	Text	Yes	No	The client ID the API issued when you registered an application with it.
auth.clientSecret	Password	Yes	Yes	The client secret issued alongside that client ID.
auth.scopes	Text	No	No	Space-separated scopes to request. Ask for the narrowest set the workflow needs. Optional.

Access-token request builder

For APIs whose token exchange does not follow OAuth. You describe the request that fetches a token, where in the response the token is, and how to refresh it.

No credential fields are collected for this option in the guided setup.

Signed JWT

For APIs that want a signed JWT as the credential. You supply the signing key and the claims; presets exist for the common providers.

No credential fields are collected for this option in the guided setup.

Picking the right option

A token in a header (Authorization: Bearer …, X-API-Key: …) — choose No authentication and add the header on the connection's settings page, marking it sensitive so it is stored as a secret.

Username and password — HTTP Basic. If the docs say "use your API key as the username and leave the password blank", that is still Basic.

Client ID and secret exchanged for a token — OAuth 2.0 client credentials. If the token endpoint rejects the request, try auth.clientAuthInBody: providers differ on whether the credentials belong in the header or the body.

"Sign in with…" on behalf of a user — OAuth 2.0 authorization code. A person approves access in a popup; Honeybase keeps the refresh token and never asks you to type one.

Anything else — Access-token request builder describes a non-standard token exchange as a request and a path into its response. Signed JWT covers APIs that want a JWT you sign yourself.

Headers and query parameters

Default headers and query parameters are set on the connection's settings page rather than in the guided setup, because each one carries its own "this is sensitive" flag — the ones you mark sensitive go to the secret store, and the rest stay readable. Everything you add there is sent with every request the connection makes.

Base URLs

Point baseUrl at the stable part of the API — https://api.example.com/v2 rather than https://api.example.com — and let each node supply the rest of the path. Moving from staging to production then means editing one connection.