Web API - how secure is the Key if it is placed here?

Hi Anonymous,

I've forgotten to mention how it works in PBI Service.

You have to set up either a gateway connection and/or data source credentials. Both are saved in the cloud and your users won't see the credentials.

More about that: https://docs.microsoft.com/en-us/power-bi/refresh-scheduled-refresh

Thank you for the info. This is helpful, but for us, it is not a complete or "official" answer.

I have seen that blog. We are using Web API with the key, and assume it is best practrices and "secure", but we don't actually know waht theat means or how it works:

where is the key stored? how is it stored?

when someone downloads the workbook from PBIS, can they see the key in the workbook?

Thanks for the help, but we are looking for official documentation from MSFT on storing keys and keeping them secure --> secrets management in PBID (PBIX) and PBIS.

Thanks for the reply, this is useful, but we would like to get official documentation so we can be certian.

Here is the quote in the blog:

"After this the API token gets stored separately from the query in the secure credentials store and you don’t need to enter it again each time the query runs; this also means that the API token will not travel with the workbook if you email it to someone else, for example."

which is great - but we would like to understnad more how this works. what is the "secure credentials store"? how does it interact between the PBIX (PBID) and PBIS?