Protection of API Keys Stored in Parameter

HI jasonmull,

As lbendlin said, you can attach your API key directly to the API request. (I think these operations only suitable when you work with a test data source or test in a secure environment)

If you are work with a production environment or do these operations in no security network/devices, they may cause security issues for API key leakage.

For this scenario, It should more suitable to move these verify steps into your query steps and only generate the tokens when your query steps processed. (for the requests which power bi processed, they are been encrypted by power bi)

Power BI security whitepaper 

For example: credilents has been integrated into the query steps instead of use the real strings in send/receive operations.

 let
	rooturl = "https:/xxxx.xxxx.com/",
	authKey = "xxxxx",
	// Use the oauth2/token method to get token based on user credentials.
	GetJson = Web.Contents(rooturl,
		[
			Headers = [#"Authorization"=authKey, #"Content-Type"="application/json"],
			RelativePath="xxx/user/auth"
		]
	),
	//use token name to repalce 'tokne name' part to extract the responsed token
	token = Json.Document(GetJson)['token name'],
	//use generated token to get correspond results
	Source = Web.Contents(rooturl,
		 [
			 Headers = [#"token"=token, #"Content-Type"="application/json"],
			 RelativePath="xxxx/usage/xxxx" 
		 ]
	 ),
	Result=Json.Document(Source)
 in
	Result

Regards,

Xiaoxin Sheng