How do I connect an API to Lovable?

Describe the API and what you want it to do in Chat; Lovable will typically wire the call through a server function (Edge Function) so any API key stays off the client.

How do I connect Stripe?

Use Lovable's built-in Payments feature where available; for anything it doesn't cover, ask Lovable to wire Stripe through a server function that keeps your secret key off the client.

How do I accept payments?

Ask Lovable to add its built-in Payments feature (backed by Stripe) for checkout; it handles one-time payments and subscriptions without you managing raw API keys in the UI.

How do I create subscriptions?

Set up recurring prices in Stripe, then ask Lovable to create checkout for those prices and store each user's subscription status in your database so you can gate features accordingly.

How do I connect OpenAI?

For most cases, use Lovable AI (the built-in AI Gateway) so users don't need their own key; if you specifically need OpenAI, ask Lovable to store your API key as a secret and call it from a server function.

How do I connect Google Maps?

Get a Google Maps API key restricted to your domain, store it as a secret, and ask Lovable to embed the map component using that key server-side where possible.

How do I connect Google Analytics?

Ask Lovable to add your Google Analytics measurement ID as a script/tag in the site's head, or install it via Google Tag Manager for more flexibility.

How do I install Google Tag Manager?

Ask Lovable to add your GTM container snippet to the site's shared head and body, then manage individual tags (analytics, ads, pixels) from within Tag Manager itself.

How do I connect Meta Pixel?

Ask Lovable to add your Meta Pixel ID as a script in the site's shared head, and fire a PageView (or custom) event on each route change since Lovable apps are single-page apps.

How do I add a booking system?

For simple scheduling, embed an existing tool like Calendly; for a fully custom booking flow, ask Lovable to build a bookings table with availability logic backed by Lovable Cloud.

How do I embed Calendly?

Ask Lovable to embed your Calendly link using Calendly's inline widget or popup script on the relevant page.

How do I connect Shopify?

Connect via Shopify's Storefront API (for product/catalogue data) or link out to an existing Shopify checkout; Lovable doesn't replace Shopify's backend, it calls into it.

How do I connect an external CRM?

Ask Lovable to build a server function that sends or fetches records via your CRM's REST API (HubSpot, Salesforce, Pipedrive, etc.), using an API key stored as a secret.

How do I connect an email marketing platform?

Ask Lovable to send new subscribers or events to your email platform's API (Mailchimp, ConvertKit, Klaviyo, etc.) via a server function using an API key stored as a secret.

How do I use webhooks?

Webhooks let external services notify your Lovable app when something happens; ask Lovable to create a server function URL as the webhook endpoint, and configure that URL in the third-party service.

How do I receive webhook data?

Ask Lovable for a server function that accepts incoming POST requests, verifies the sender where possible, then stores the payload in your database.

How do I securely call third-party APIs?

Keep every API key and secret server-side in a Lovable Cloud/Supabase server function, never in front-end code, and have your UI call that function instead of the third-party API directly.

Why is my API working in preview but not production?

Last checked 31 Aug 2026

Short answer

This is usually a missing secret, environment mismatch, or a domain restriction that only applies once the app is published — check that every secret and allowed-domain setting has been applied to production, not just preview.

Most likely causes, in order of frequency

Secret not set for the published app. Some setups keep preview and production configuration separate — confirm the API key/secret was saved and is actually available to the deployed server function, not just during your Chat session.
Domain/referrer restrictions. Keys restricted to specific domains (common with Google Maps, and CORS allow-lists on APIs you call) often only include your preview URL or localhost, not your published custom domain. Add the production domain to the allow-list.
Different environment variables. If the third-party service has separate test/live keys (Stripe is the classic example), check you're using live keys in production and test keys only in preview.
CORS configuration on the third-party API restricting which origins can call it — preview and production are different origins.
Webhook URLs pointing at the wrong environment, so events land nowhere once you've published.

How to check systematically

Ask Lovable to confirm which secrets exist and whether they're populated.
Open your browser's developer console/network tab on the production URL and look at the actual error returned by the third-party API — "unauthorized", "forbidden", "origin not allowed" all point to different causes above.
Compare the production custom domain against every allow-list (API key restrictions, CORS settings, OAuth redirect URLs) you configured during setup.
Check the provider's own dashboard/logs (Stripe, Google Cloud, etc.) for the actual rejected request — most log the reason.

What usually goes wrong

Restricting an API key to localhost or the Lovable preview domain during testing and forgetting to add the real production domain before publishing.
Test-mode keys left in place after going live, which some providers block for real traffic.
Publishing to a new custom domain without updating OAuth redirect URIs or webhook URLs registered with the third party.

If you've checked the obvious causes and it's still failing, PromptSites.com can trace it through the logs and fix the underlying config.

Sources

Deployment, hosting, and ownership options with Lovable

Was this answer helpful?

You might also need

GuideHow to Connect an External APICall third-party APIs from server code, handle their errors properly, and never expose your keys.