API authentication error on scheduled refresh

Hello
This happens because Power BI Service handles Web.Contents() authentication differently from Desktop.
Even though the API key is passed in headers, the Service often blocks scheduled refresh when the URL is treated as a dynamic data source.

The fix is usually to:

1. Keep the base URL static

2. Move the dynamic part into RelativePath

3. Set credentials to Anonymous

4. Avoid hardcoding changing URL segments directly in Web.Contents

Use this pattern instead:

let
    BaseUrl = "https://api.csassurance.com/",
    
    Source =
        Json.Document(
            Web.Contents(
                BaseUrl,
                [
                    RelativePath = "api/v2/reports/ReportUUIDHere/snapshot",
                    Headers = [
                        #"X-Api-Key" = "APIHere",
                        #"X-Tenant" = "ABC"
                    ]
                ]
            )
        )
in
    Source

Then in Power BI Service:

• Go to Dataset Settings

• Data source credentials

• Set authentication to:

  • Anonymous

  • Privacy level = Public (or Organizational)

This works because Power BI Service can validate a fixed root domain (https://api.csassurance.com/) during scheduled refresh. Directly embedding the full URL inside Web.Contents() often causes refresh failures in the Service even if Desktop works fine.

Hi Rabi,

Hope you're doing well!

Root Cause:

The issue is a known Power BI Service limitation: when using Web.Contents with hardcoded headers containing credentials, the gateway/refresh engine blocks or strips custom headers for security reasons, even with Anonymous authentication.

Solution:

Use the RelativePath + Query pattern with Web.Contents

Power BI Service requires Web.Contents to have a static base URL (evaluated at authoring time) with dynamic parts passed via RelativePath or Query. This is what allows the refresh to work correctly.

Rewrite your M query like this:

let

    BaseUrl = "https://api.csassurance.com",

    Source = Json.Document(

        Web.Contents(

            BaseUrl,

            [

                RelativePath = "api/v2/reports/ReportUUIDHere/snapshot",

                Headers = [

                    #"X-Api-Key" = "APIKeyHere",

                    #"X-Tenant" = "ABC"

                ]

            ]

        )

    )

in

    Source

Additional Steps in Power BI Service:

Go to Dataset Settings → Data Source Credentials

Set authentication to Anonymous

Set Privacy Level to None or Organizational (avoid "Private" as it can block requests)

Untick "Skip test connection" if it's ticked

If It Still Fails → Use a Custom Connector or Parameter-based approach

If headers are still being stripped, consider storing credentials in Power BI Parameters and referencing them — though for API keys the RelativePath fix above resolves it in the vast majority of cases.

Hope this helps! If OK don't forget to mark as solution and thumbs up, that's motivate me to keep helping 🙂 

Hi Rabi , Thank you for reaching out to the Microsoft Community Forum.

Power BI Service handles Web.Contents differently than Desktop and often fails scheduled refresh when the full URL is embedded directly in the function. Keep the base domain static and move the endpoint into RelativePath, then configure the datasource in the Service as Anonymous. Your custom headers (X-Api-Key and X-Tenant) can still be passed in the Headers record.

After publishing, reconfigure the dataset credentials in the Service as Anonymous and set the privacy level to Organizational or Public. In most cases this resolves the refresh issue.