Forum Discussion

daircom's avatar
daircom
Icon for Resolver II rankResolver II
4 hours ago

How to properly store a REST API Key

Hi all,

I am connecting to a REST API via the web connector.

However, this API works with a personal access token. We do not have a company wide account / token.

So if my colleague (the Power BI admin) downloads the .pbix he has my personal access token (refered to as "Token" in the M code below).

so my question is: how to let Power BI use my personal access token to fetch data, without people (who have the rights) who download the pbix from app.powerbi.com having access to my token?

I have been looking around for a while but  surprisingly there is no solution for this. I am unable to use OAuth or something to connect.... 

 

 

let
    Token = "xxx",
    Source =
        Json.Document(
            Web.Contents(
                "https://jira.company.nl",
                [
                    RelativePath = "jira/rest/api/2/search",
                    Query = [
                        jql = "project = company_project",
                        maxResults = "100",
                        startAt = "0"
                    ],
                    Headers = [
                        Authorization = "Bearer " & Token,
                        Accept = "application/json"
                    ]
                ]
            )
        ),

 

 

data protection

5 Replies

  • Tahreem24's avatar
    Tahreem24
    Icon for Super User rankSuper User
    2 hours ago

    daircom​ ,

    Any token written in the M code, or stored in a Power Query parameter, is saved inside the PBIX. Anyone who downloads the file can read it. Blocking downloads doesn't help here either, because the person downloading is the admin. To protect the token, move it out of the PBIX into a secure credential store.

    1. Separate extraction layer (most robust). A Fabric notebook, Data Factory pipeline, Azure Function or Logic App calls the Jira API, with the token kept in Azure Key Vault. It writes the results to a Lakehouse, Warehouse or SQL table, and Power BI connects to that table instead of the API. This also makes refreshes faster and easier to manage, and it avoids Jira paging limits.
    2. Custom connector (.mez). Build a small Power Query custom connector using the Key authentication type, which adds Authorization: Bearer <key> to each request. The token is then entered in Data source credentials. Power BI stores it encrypted, outside the PBIX. Refreshes in the service need an on-premises data gateway with the connector installed.
    3. Built-in Web credentials, only if Jira accepts them. Remove the token from the M code and enter it in the credentials dialog instead:
      • Basic auth: Web.Contents with no Authorization header, then Basic credentials. This works if your Jira server allows a username with a password or API token, as Jira Cloud does with email plus API token. Jira Data Center personal access tokens (PATs) usually need Bearer, so this may not work.
      • Key in the URL: Web.Contents(url, [ApiKeyName="token"]) with Web API credentials. This only works if the API accepts the key as a query-string parameter.

    Also

    • Use a service or technical account token, not your personal one. Otherwise refreshes stop when you leave, and every call runs under your own permissions.
    • Rotate the token now if a PBIX containing it has already been published or shared.
  • DaniyalKhaleel1's avatar
    DaniyalKhaleel1
    Icon for Resolver II rankResolver II
    1 hour ago

    The best approach is to use Azure Function + Azure Key Vault to protect your personal Jira API token.

    How it works

    1. Store your personal access token (PAT) securely in Azure Key Vault.

    2. Create an Azure Function that retrieves the token from Key Vault.

    3. The Function calls the Jira REST API using your token.

    4. Power BI connects to the Azure Function instead of directly connecting to Jira.

    5. Secure the Function using Microsoft Entra ID so only authorized users or services can access it.

    Why this approach?

    Your PAT is never stored in Power Query (M code).

    Anyone downloading the PBIX cannot retrieve your token.

    You can rotate the token without modifying the PBIX.

    You can control access to the API through Azure.

    Alternative: Ask your Jira administrator to create a company-managed service account with its own PAT. This is generally the simplest long-term solution.

    Important: Protecting the token does not prevent users with PBIX access from extracting data already imported into the Power BI model.

  • daircom's avatar
    daircom
    Icon for Resolver II rankResolver II
    1 hour ago

    DaniyalKhaleel1​ , thanks for your reply. Does this mean that when power bi refreshes, it calls the function? and the resulting DataFrame enters power query as a table?