quickbase-codepage

Quickbase code page

Build a browser-delivered code page — self-contained HTML/CSS/JS stored in a Quickbase app — that does its work client-side and authenticates as the logged-in user via their existing Quickbase session, so no secret ever lives in the page. Use this to turn a Python script (usually REST /v1 with a hardcoded QB-USER-TOKEN) into an in-app widget, or to build a code page from scratch.

New to code pages, or the user asks "how do I make one?" → the full creation guide (click-path, addressing, embedding, limits) is in the repo at codepages/README.md; the full auth model is in codepages/authentication.md. This skill is the hands-on build workflow.

The one hard rule

Never put a QB-USER-TOKEN (or any REST /v1 user token) in a code page. Code pages are downloaded in full to every viewer's browser — "View Source"/DevTools expose every string. A user token is a real credential with its owner's full permissions; in a page it is handed to everyone who can open it. The .py's token is for server-side use only. In a code page, auth comes from the user's existing QB session cookie via the classic XML API. (An app token is fine to include when the app requires one — it is a low-sensitivity gate, not a user secret. If the page must exceed the viewer's own permissions, see Elevated access below — the answer is a server-side proxy, still never a user token in the page.)

Auth pattern (the whole point)

Call the classic XML API with the session cookie. Same-origin relative URL → the browser sends the QB session (ticket) cookie → QB runs the query as that user, under their permissions:

fetch('/db/<tableDbid>?act=API_DoQuery&fmt=structured&clist=<f.f.f>&query=<q>', { credentials:'include' })

• Add &apptoken=<token> only if the app has "Require Application Tokens" enabled (config field or ?appToken= param).
• Query syntax: {'<fid>'.EX.'<value>'} (EX equals, XEX not-equal, CT contains, GT/LT/GTE/LTE, OAF/BF for dates; combine with AND/OR). clist = field ids joined by .; slist = sort fid; paginate with options=num-N.skp-M.
• Parse with DOMParser('text/xml'). Read <errcode>: 4 = bad/expired ticket, 22 = sign-in required → both mean prompt re-login (do NOT key off 10 — that is "invalid field type"). Records are <record rid=".."> with <f id="N">value</f>. Date/DateTime fields come back as ms-since-epoch at UTC midnight → use getUTC*. File-attachment fields carry a <url> child.
• Don't know the field ids? Resolve at runtime with act=API_GetSchema (map <field id>→ <label>), or hardcode them.
• Want REST/JSON instead of XML? Mint a temporary token (GET https://api.quickbase.com/v1/auth/temporary/<tableDbid> with the session; 5-min life; still the same user, no elevation). Details in codepages/authentication.md.