Forum Discussion

LW07's avatar
LW07
Frequent Visitor
6 months ago
Solved

API secrets without Azure Key Vault

Hi I'm currently learning to work with Fabric. One of my learning tasks is translating our old processes into Fabric native processes. I need to hold an API key and secret but my own Azure permissions are limited, so I cannot access Key Vault and will not be given access. This is purely research and development work so getting that access or having anything set up for me is bottom of the priority list. In development testing the only way I know will work to call the API is via hardcoding in a notebook. Obviously I don't want to do that. Is there an alternative method for holding the API information as part of a pipeline or otherwise? This feels like a bit of a stumbling block related to the differences in Fabric and Azure administration.

  • Hi LW07 ,

     

    you have two options for reading a secret from a Key Vault.

     

    Option 1:

    As already described by deborshi_nag , you use the Fabric Connection with Notebook. However, this is still in preview. You also need permissions on the Key Vault to read it. 

     

    Option 2:

    You use code to read the data from a Key Vault. The administrator of your organization must also assign you the role “Key Vault Secrets User.” Then you can read the secrets.

     

    Here an Example to read from with python. In my example, I define a few parameters in the notebook beforehand. You don't necessarily need them.

     

    import requests
    
    app_client_id = mssparkutils.credentials.getSecret(f"https://{key_vault_name}.vault.azure.net/", kvclientid_1)

     

    For security reasons, I advise against writing secrets in plain text anywhere. If possible, you should always use a key vault.

     

    I hope this helps.

     

    Best regards.

    Rene

     

    Feel free to leave kudos or accept it as a solution. This will also help other community members.

     

  • There aren't really any good solutions that don't involve invoking assistance from other members of staff who have Azure responsibilities. So I don't think my question is resolved in the format I would prefer it, but I appreciate the responses from everyone. Many thanks. 

8 Replies

  • Hello, 

    Ideally, as you know, you'd use a key vault, but since you don't have one, do you have a Lakehouse? You could store them in a text file, even encoded, and then read them from your notebook.

  • LW07's avatar
    LW07
    Frequent Visitor

    There aren't really any good solutions that don't involve invoking assistance from other members of staff who have Azure responsibilities. So I don't think my question is resolved in the format I would prefer it, but I appreciate the responses from everyone. Many thanks. 

  • LW07's avatar
    LW07
    Frequent Visitor

    Thanks for the options, deborshi_nag unfortunately it's OAuth2 I need to use which isn't supported as per the document you sent.

    Fran-Diaz I will use a file in the lakehouse for now I think.

    • spaceman127's avatar
      spaceman127
      Super User

      Hi LW07 ,

       

      you have two options for reading a secret from a Key Vault.

       

      Option 1:

      As already described by deborshi_nag , you use the Fabric Connection with Notebook. However, this is still in preview. You also need permissions on the Key Vault to read it. 

       

      Option 2:

      You use code to read the data from a Key Vault. The administrator of your organization must also assign you the role “Key Vault Secrets User.” Then you can read the secrets.

       

      Here an Example to read from with python. In my example, I define a few parameters in the notebook beforehand. You don't necessarily need them.

       

      import requests
      
      app_client_id = mssparkutils.credentials.getSecret(f"https://{key_vault_name}.vault.azure.net/", kvclientid_1)

       

      For security reasons, I advise against writing secrets in plain text anywhere. If possible, you should always use a key vault.

       

      I hope this helps.

       

      Best regards.

      Rene

       

      Feel free to leave kudos or accept it as a solution. This will also help other community members.

       

    • v-menakakota's avatar
      v-menakakota
      Community Support

      Hi LW07 ,

      Thanks for reaching out to the Microsoft fabric community forum. 

       

      I would also take a moment to thank Fran-Diaz   , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.

      I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you .

       

       

      Best Regards, 
      Community Support Team

      • v-menakakota's avatar
        v-menakakota
        Community Support

        Hi LW07 ,

        I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you

         

        Best Regards, 
        Community Support Team 

  • Lozovskyi's avatar
    Lozovskyi
    Kudo Collector

    Hello LW07,

    If you need an API key in a pipeline, you can use a secure string

    However, wouldn't recommend doing that for the long term as it's very weak.