Navigation

External Connections Audit

Complete inventory of all external services, APIs, and data flows in Snappy Idioms

Last Updated: January 2026
8
Active Connections
13
Secrets Configured
2
High Risk Services
2
OAuth Connectors
Data Flow Summary
How data moves between services
User BrowserBase44 Frontend(Page requests, form inputs, clicks)
Base44 FrontendBase44 Backend(Entity CRUD, auth tokens)
Base44 BackendDeno Functions(HTTP requests to functions/)
Deno FunctionsGoogle Cloud(TTS audio, translations, images)
Deno FunctionsStripe(Checkout sessions, webhooks)
Deno FunctionsFirebase(Push notifications)
Deno FunctionsOpenAI(Chat completions)
Deno FunctionsSupabase(File storage)
Stripe WebhookstripeWebhook.js(Payment events)
Base44 Platform
Primary hosting, authentication, and backend-as-a-service platform
active
low risk
Data IN (What we send)
  • •
    User auth tokens→ Frontend pages
  • •
    Entity data requests→ base44.entities.* calls
  • •
    Backend function calls→ Deno deploy handlers
Data OUT (What we receive)
  • •
    User sessions→ Browser cookies
  • •
    Entity records (JSON)→ Frontend state
  • •
    Function responses→ Frontend handlers
APIs Called
  • base44.auth.me()
  • base44.entities.*.list()
  • base44.entities.*.filter()
  • base44.entities.*.create()
  • +4 more...

Notes: Core platform - all entity operations go through here. Known stability issues with complex filtering.

Supabase
File storage and potential future database migration target
active
low risk
Data IN (What we send)
  • •
    File uploads (images, audio, video)→ Storage buckets
Data OUT (What we receive)
  • •
    Public file URLs→ Idiom image_url, video_url, audio_url fields
  • •
    Signed URLs for private files→ Premium content delivery
Secrets Used
SUPABASE_URL
SUPABASE_SERVICE_KEY
APIs Called
  • Storage bucket uploads
  • Public URL generation
  • Signed URL generation for private files

Notes: Currently used primarily for file storage. Planned as migration target for entities.

Google Cloud Platform
Text-to-Speech, Translation, Vision AI, and Vertex AI Imagen
active
medium risk
Data IN (What we send)
  • •
    Text for speech synthesis→ speakText.js function
  • •
    Text for translation→ translateWithGoogle.js function
  • •
    Image prompts→ generateIdiomImageV2.js function
  • •
    Images for moderation→ moderateImageWithVision.js function
Data OUT (What we receive)
  • •
    MP3 audio (base64)→ Browser audio playback
  • •
    Translated text→ Dictionasaurus, Quiz pages
  • •
    Generated PNG images→ Idiom illustrations
  • •
    Content safety scores→ Image moderation results
Secrets Used
GOOGLE_CLOUD_CREDENTIALS
API_TRANSLATE_KEY
APIs Called
  • texttospeech.googleapis.com/v1/text:synthesize
  • translation.googleapis.com/language/translate/v2
  • us-central1-aiplatform.googleapis.com (Vertex AI Imagen)
  • vision.googleapis.com (Safe Search)
  • +1 more...

Notes: Service account auth via JWT. Credentials JSON contains private key. Cost per API call.

Est. Cost: TTS: ~$4/1M chars | Translation: ~$20/1M chars | Imagen: ~$0.02/image

Firebase (FCM)
Firebase Cloud Messaging for push notifications
active
low risk
Data IN (What we send)
  • •
    Notification title/body→ sendFirebaseNotification.js
  • •
    User FCM tokens→ User entity fcm_token field
  • •
    Click URL targets→ Notification deep links
Data OUT (What we receive)
  • •
    Push notifications→ User browsers/devices
  • •
    Message IDs→ NotificationLog entity
  • •
    Delivery status→ NotificationLog entity
Secrets Used
FIREBASE_ADMINSDK
FIREBASE_SERVICE_ACCOUNT_JASON
APIs Called
  • fcm.googleapis.com/v1/projects/{id}/messages:send
  • oauth2.googleapis.com/token (service account auth)

Notes: Service account auth. FCM tokens stored per-user. Requires HTTPS and browser permission.

Stripe
Payment processing for premium subscriptions and currency packs
active
high risk
Data IN (What we send)
  • •
    Checkout session requests→ createPremiumCheckout.js
  • •
    Webhook events→ stripeWebhook.js
  • •
    Customer metadata→ User email, pack details
Data OUT (What we receive)
  • •
    Checkout URLs→ Redirect to Stripe hosted page
  • •
    Payment confirmations→ User entity updates (is_premium, pearls_of_wisdom)
  • •
    Subscription status→ User entity stripe_subscription_id
Secrets Used
STRIPE_SECRET_KEY
STRIPE_WEBHOOK_SECRET
APIs Called
  • api.stripe.com/v1/checkout/sessions
  • api.stripe.com/v1/prices
  • api.stripe.com/v1/customers
  • Webhook: checkout.session.completed

Notes: Webhook signature validation critical for security. Test vs Live mode keys.

Est. Cost: Stripe fee: 2.9% + 30¢ per transaction

OpenAI
GPT models for AI conversation practice and content generation
active
medium risk
Data IN (What we send)
  • •
    Chat prompts→ chatWithGPT35.js, chatWithGemini.js
  • •
    System instructions→ AI tutor personas
  • •
    User messages→ ConversationPractice page
Data OUT (What we receive)
  • •
    AI responses→ Chat UI, feedback, analysis
  • •
    Structured JSON→ Quiz analysis, content moderation
  • •
    Token usage→ AIMessageLog entity (rate limiting)
Secrets Used
OPENAI_API_KEY
APIs Called
  • api.openai.com/v1/chat/completions (GPT-3.5, GPT-4)
  • Base44 built-in: InvokeLLM integration

Notes: Rate limiting implemented. Token costs tracked. Free tier users limited to 10 msgs/hour.

Est. Cost: GPT-3.5: ~$0.002/1K tokens | GPT-4: ~$0.03/1K tokens

Web Push (VAPID)
VAPID keys for web push notification subscriptions
active
low risk
Data IN (What we send)
  • •
    Push subscription requests→ Browser PushManager
Data OUT (What we receive)
  • •
    Push subscription objects→ User entity fcm_token
  • •
    VAPID public key→ Frontend for subscription
Secrets Used
VAPID_PUBLIC_KEY
VAPID_PRIVATE_KEY
APIs Called
  • Browser Push API
  • Service Worker registration

Notes: Public key exposed to frontend. Private key used server-side only.

Sentry
Error tracking and performance monitoring
configured
low risk
Data IN (What we send)
  • •
    Error events→ Frontend catch blocks
  • •
    Performance traces→ Page load timing
Data OUT (What we receive)
  • •
    Error reports→ Sentry dashboard
  • •
    Alert notifications→ Email/Slack (if configured)
Secrets Used
SENTRY_DSN
APIs Called
  • sentry.io/api/{project}/envelope/

Notes: DSN contains project identifier. No sensitive data should be logged.

Services NOT Connected

Google Sheets (OAuth)

No OAuth app connector authorized. Would enable spreadsheet access.

Recommendation: Connect for bulk import/export of idioms, gradebooks, analytics.

Vercel

Previously used for standalone crossword. Currently inactive.

Recommendation: Re-enable if standalone crossword app deployment is needed.

Security Summary

✅ Good Practices

  • • All secrets stored in Base44 environment variables
  • • Stripe webhook signature validation
  • • JWT-based service account auth for Google
  • • User auth required for most API calls
  • • Rate limiting on AI endpoints

⚠️ Considerations

  • • Google Cloud credentials contain private key
  • • Stripe keys = full payment access
  • • No OAuth app connectors (manual API keys)
  • • Firebase service account has admin access
  • • OpenAI API key = pay-per-use billing