Forum Discussion
REST API Bearer Token security (3rd party developer)
Hi cwisoff ,
Thanks VahidDM for the detailed breakdown, that really cleared things up. The OAuth2 route definitely seems like the more secure way forward. For anyone else starting out, the most reliable docs are.
- Power Query SDK - Visual Studio Marketplace build a custom connector with OAuth2.
- The authentication API in Power BI custom visuals - Power BI | Microsoft Learn explains Desktop vs Service behavior.
- Handling authentication for Power Query connectors - Power Query | Microsoft Learn
The Crossjoin blog post OP found is also helpful, but Microsoft’s docs are the definitive source. Beginning with the SDK samples is usually the smoothest way to see how refresh tokens and automatic refresh work end-to-end.
Regards,
Akhil.
Hi cwisoff ,
Did you get a chance to try setting up the OAuth2 flow with the SDK samples yet, or are you still experimenting with other approaches?.
Regards,
Akhil.
We are going to start by just implementing a long-lived bearer token. We're a small startup and the data we're exposing isn't very sensitive (i.e. no PII). This will unblock some other work. We're looking to implement Oauth in the next couple of months.
