Protect my API Key when using HTTP POST method

[fiscd]

Is there anyway for me to hide my API key in the below example? Any and all help is appreciated, thank you.

Identifying info has been obscured. This will be part of a PBIS report that will be published to an On-Premise PowerBI Report Server, not PowerBI in Azure.

let
    url = "https://manage.example.com/SecurePages/API/API_Query.ashx",
    headers = [#"Content-Type" = "application/x-www-form-urlencoded"],
    postData = [
        Client_ID = "1234", API_KEY = "My Super Secret base64 encoded username:password"
    ],
    response = Web.Contents(
        url,
        [
            Headers = headers,
            Content = Text.ToBinary(Uri.BuildQueryString(postData))
        ]
    ),
    jsonResponse = Json.Document(response)
in
    jsonResponse

[v-eqin-msft]

Hi @fiscd ,

Could you tell me if my post helps you? If it is, kindly Accept it as the solution to make the thread closed. More people will benefit from it.

Best Regards,
Eyelyn Qin

[v-eqin-msft]

Hi @fiscd ,

you can attach your API key directly to the API request. (I think these operations only suitable when you work with a test data source or test in a secure environment)

If you are work with a production environment or do these operations in no security network/devices, they may cause security issues for API key leakage.

For this scenario, It should more suitable to move these verify steps into your query steps and only generate the tokens when your query steps processed. (for the requests which power bi processed, they are been encrypted by power bi)

A similar thread: https://community.powerbi.com/t5/Developer/Protection-of-API-Keys-Stored-in-Parameter/m-p/1564020

Refer to:

Power BI-Whitepaper zur Sicherheit - Power BI | Microsoft Docs

Power BI-Whitepaper zur Sicherheit - Power BI | Microsoft Docs

Best Regards,
Eyelyn Qin
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[lbendlin]

I have seen scenarios where the API key is sourced from a separate query (like a text file stored on an on-prem web server).  You'll need to to feed the formula firewall monster though so your mileage may vary.