How to call API requiring mTLS + client credential authentication?

Hi caffineaddict19 ,

To call an API requiring mTLS (mutual TLS) + client credentials authentication and set it up for scheduled refresh in Power BI Service, here’s a breakdown:

1. Using a Custom Connector (Preferred Method)

• Create a custom Power BI connector using the Power Query SDK in Visual Studio.
• Configure the custom connector to handle mTLS by embedding the client certificate into the connector. This requires:
  • Installing the certificate on the machine running Power BI Desktop.
  • Adding the necessary code in the connector to present the certificate when calling the API.
• Deploy the custom connector to the On-Premises Data Gateway and enable it for Power BI Service refresh.

Key Points:

• Ensure the custom connector handles both mTLS and token retrieval using client credentials flow.
• Certificates need to be installed and managed securely on the gateway machine.

2. Using a Proxy API (Simpler Alternative)

• Set up a proxy API that manages mTLS and client credential authentication.
• The proxy acts as an intermediary: Power BI connects to the proxy (which doesn’t require mTLS), and the proxy handles authentication with the target API.
• Use a custom connector or DirectQuery in Power BI to call the proxy API.
• This reduces complexity in Power BI but requires maintaining the proxy.

Key Points:

• Ensure the proxy is secure and properly authenticated.
• Might be more manageable if the API setup or certificate rotation is complex.

3. Choosing Between the Two

• Use a custom connector if you want to avoid the overhead of managing a proxy.
• Use a proxy API if the mTLS setup is complex or if multiple services need to consume the same data.

4. On-Premises Data Gateway

• Required for both methods if using a custom connector or accessing on-prem data sources.
• Ensure the gateway supports the custom connector and is configured for scheduled refresh.

Conclusion

If you can manage mTLS and client credential flow in a custom connector, that’s the ideal solution for direct integration. However, a proxy API simplifies the setup at the cost of adding an intermediary. Both methods work with Power BI Service scheduled refresh when properly configured.

Please mark this as solution if it helps. Appreciate Kudos