Button URL specific record with Everyone on the Internet

Yes, when I removed the secret code checkbox = checked custom rule, everything worked perfectly.  Add the custom permission and it fails. Very odd. 

If you sign off of QuickBase or better yet for testing use an alternate Browser which is not logged in, can you view the record?  Can you edit the record manually while not logged in?

I can edit and view the record manually, but when I try the URL where I update fields then display the page it fails. 

So for the starrt of your formual whic is someting like this

URLRoot()&"DB/"&[_DBID_xxxxx]  &"?A=API_EDITRECORD&rid="&[Record ID#]
& "&_fid_22=" & ToText(Now())
& "&_fid_999=" & ToText([Calculated Secret Code]

... is that table being edited open to everyone on the internet?  ie is is the same table for API_EditRecord and the table for "?a=er

Correct, same table in both places.

I'm grasping a bit now.  Have you disabled the need for Application Tokens in App Properties?

Correct, Application Tokens have been disabled.  I can get around it using dynamic form rules, but really just wanted something at the User permission level. 

I think I have two suggestions.  One is to ask support if there is anything else you need to specify when using an API like that.  But I'm note sure if support offers API help.

Plan B is to set up a single generic userid for the button to use to sign in.


var text URLONE = urlroot() & "db/main?act=API_Authenticate&username=xxx&password=yyyyyy";

var text URLTWO = URLRoot()&"DB/"&[_DBID_xxxxx]  &"?A=API_EDITRECORD&rid="&[Record ID#]
& "&_fid_22=" & ToText(Now())
& "&_fid_999=" & ToText([Calculated Secret Code];

var text URLTHREE = URLRoot() & "db/" &[_DBID_xxxxx] & "?a=er&key="&[Record ID#]&"&dfid=12";

$URLONE 
& "&rdr=" & URLEncode($URLTWO)
& URLEncode("&rdr=" & URLEncode($URLTHREE))

Thanks, I will try that.  Great suggestion. 

One final question (I hope),  if you recall I am remove the 'calculated secret code' at save&close and the check formula is unchecked basically securing the record.  Is there a way to clear that field if the user hits cancel?