How do I call ElevenLabs and other APIs from my backend?

This builds on a connected managed backend. Two pieces make external calls safe: an encrypted secret store (where the key lives, server-side, never sent to the browser) and function templates that run on the backend and make the outbound request with that key injected.

What you'll learn

• Where to store a third-party API key so it never reaches the client
• The one-liner to call ElevenLabs text-to-speech from your app
• How to call any allow-listed API with the generic http-fetch function
• Why there's an allow-list, and what it protects you from

Step 1 — store the key as a secret

Open lingcode.dev/backends (signed in with the same account as your IDE), pick your backend, and go to Settings → Secrets & integrations. Add a secret with an UPPER_SNAKE name and paste the value — for ElevenLabs that's ELEVENLABS_API_KEY. It's encrypted at rest (AES-256-GCM) and the console only ever shows you the key names afterward, never the values. Nothing about this secret is reachable from your app's code or network — only backend functions can read it.

Step 2 — call ElevenLabs in one line

There's a vetted elevenlabs-tts function built in. From your app (using the LingCode SDK the agent already wires up):

const { data } = await client.functions.invoke('elevenlabs-tts', {
  text: 'Hello from LingCode Cloud',
  // voice_id and model_id are optional
});
// data.audio_base64 is MP3 audio you can play:
new Audio('data:audio/mpeg;base64,' + data.audio_base64).play();

The function runs on the backend, reads ELEVENLABS_API_KEY from the vault, calls ElevenLabs, and returns the audio. Your frontend never sees the key. If you ask the agent ("add a button that reads this text aloud with ElevenLabs"), it knows this template exists and writes exactly this call.

Step 3 — any other API with http-fetch

For a service without a dedicated template, use the generic http-fetch — but first allow-list its domain under Settings → Allowed fetch hosts (e.g. api.openai.com). Then:

const { data } = await client.functions.invoke('http-fetch', {
  url: 'https://api.openai.com/v1/responses',
  method: 'POST',
  headers: { Authorization: 'Bearer {{OPENAI_API_KEY}}', 'content-type': 'application/json' },
  body: { model: 'gpt-4o-mini', input: 'Say hi' },
});

The {{OPENAI_API_KEY}} token is replaced server-side with the secret you stored — it's never in the request your app makes. data carries the response status, headers, and body (parsed JSON when applicable).

What's next