Hello,

I'm creating a widget for Zoho Creator that serves the client's need UI. The thing is, the requirement is to display all projects and their children e.g. task lists from Zoho projects in this widget. Locally I can make server-side API calls (that involve requesting an access token). I have found a similar issue in the community where someone wanted to make an external API calls via the widget. 

Whitelisting the external API address could solve the issue in case I'm making the call to some dummy API. But not when making calls to Zoho auth and Zoho projects, then I encounter cors restrictions plus all sensitive data are exposed in the browser.

As far as I know, workflows e.g. deluge scripts don't target the widget itself. In the meantime, the ZohoCreator init only makes calls to reports in Creator.
Hence the confusion on how to achieve this requirement. Any advice would be highly appreciated.