Protection of API Keys Stored in Parameter

[jasonmull]

I'm using PowerBI to pull data from a series of REST APIs.  In all cases, authentication occurs by means of an API key in the request header.  I'm successfully accomplishing this by storing the key in a parameter and referencing the parameter in my query.  My concern is over the security of this process.  Is parameter storage the best method for secure key storage in this case, and what options do I have at my disposal to protect the contents of those parameters as much as possible?

[v-shex-msft · Accepted solution]

HI @jasonmull,

As lbendlin said, you can attach your API key directly to the API request. (I think these operations only suitable when you work with a test data source or test in a secure environment)

If you are work with a production environment or do these operations in no security network/devices, they may cause security issues for API key leakage.

For this scenario, It should more suitable to move these verify steps into your query steps and only generate the tokens when your query steps processed. (for the requests which power bi processed, they are been encrypted by power bi)

Power BI security whitepaper 

For example: credilents has been integrated into the query steps instead of use the real strings in send/receive operations.

 let
	rooturl = "https:/xxxx.xxxx.com/",
	authKey = "xxxxx",
	// Use the oauth2/token method to get token based on user credentials.
	GetJson = Web.Contents(rooturl,
		[
			Headers = [#"Authorization"=authKey, #"Content-Type"="application/json"],
			RelativePath="xxx/user/auth"
		]
	),
	//use token name to repalce 'tokne name' part to extract the responsed token
	token = Json.Document(GetJson)['token name'],
	//use generated token to get correspond results
	Source = Web.Contents(rooturl,
		 [
			 Headers = [#"token"=token, #"Content-Type"="application/json"],
			 RelativePath="xxxx/usage/xxxx" 
		 ]
	 ),
	Result=Json.Document(Source)
 in
	Result

Regards,

Xiaoxin Sheng

[lbendlin]

That's not a good idea. A slightly less desastrous design would be to store the key in an external data source, slap severe access restrictions on that data source, and then pull the data source into Power Query.  That way only the report developer and the gateway connection account need to be given access to that data source. You might still need to add RLS to prevent leakage via Analyze in Excel or other XMLA endpoint tools.