Forum Discussion
Power Query custom connector with combined authentication types
Hi jnickell , Thank you for reaching out to the Microsoft Community Forum.
Extension.CurrentCredential() can only return one credential record at a time, even though VS Code shows both UsernamePassword and Key stored. The connector runtime won’t merge them, so you can’t directly retrieve both Password and Key from the same call. That’s why your current approach fails. Greg_Deckler was right that you could hardcode the API key, but that weakens security. vojtechsima correctly said, you should either stick with Dataflows (where credentials are already protected in the service and hidden from end users) or move to Fabric Notebooks/Pipelines with Key Vault for stronger enterprise security.
If you do want to continue with a connector, the usual pattern is to define a single authentication kind and pass the API key as a required parameter that you inject into the request header. That way you avoid mixing credential types, which isn’t supported. You weren’t wrong in thinking about connectors, but you’re not as exposed as you feared with Dataflows, they already give you a decent security boundary.
hey, jnickell
You can't really call an external extension, especially when you want to then use it PBI Service.
If you want a bit more secure stuff, you can build the authentication header and the API token inside Dataflow. And then inside Power Query in PBI, call the Dataflow and use the response as the parameters for your API call.
If someone without credentials to Dataflow accesses the .pbix (assume Power BI) file, they won't see the credentials there, as it requires authorisation to Dataflow.
If you want an extra "fake" security layer, store the dataflow call as a function and never return it inside a variable and then it won't be materialised in any step.
vojtechsima could you comment on my previous reply to tell me if I'm off base in my conclusion?