Forum Discussion
Solved
Protecting API keys and Credentials
Hi, If I don't have access to Azure Key Vaults now, what are the alternatives for protecting API keys and credentials in Fabric, in a shared workspace?
Hi asosman,
Key Vaults are the intended solution here. Anything you put in a workspace can be read by others with access to the workspace.
Depending on the credential type, if Fabric has a native connector for it you may be able to create a fabric connection for it, but connections are not useable in all workloads.
Anmoldeep
Helper I
Helper IHi asosman ,
you can use the following ways-
- Fabric workspace identity is GA and is an automatically managed service principal — Fabric handles the credentials, so nothing is stored anywhere. It works in OneLake shortcuts, pipelines, semantic models, and Dataflows Gen2 connections to resources that support Microsoft Entra auth (ADLS Gen2, Azure SQL, etc.).
- For pipelines hitting REST APIs: use a Web activity bound to a connection using OAuth2 or a service principal. The credential lives in the connection object — people who use the pipeline never see it.
- Variable libraries now support a dedicated Secret variable type — values are encrypted, masked in the UI, and never shown in logs, and they can be referenced from pipelines and notebooks via notebookutils.variableLibrary