External APIs

Handler-based server functions (query(), mutation(), and action()) cannot call external APIs. Their worker gives ctx.fetch() a deny-all egress policy, so it refuses every host. Adding a host to egress.allowHosts does not grant server functions network access.

For an outbound request, use a bot-module handler and declare its destination in egress.allowHosts. Bot-module ctx.fetch() applies the manifest allowlist and the egress security rules, including HTTPS-only requests, public-address checks, and a five-second request timeout.

{
  "egress": {
    "allowHosts": ["api.example.com"]
  }
}

Server functions can still use ctx.db, ctx.cache, and ctx.secrets within their handler limits. Keep any data returned to a rendered extension within the caller's intended access scope.