A Copilot Studio topic needs to call an external REST API that requires Bearer token authentication. The API key is stored as an environment variable named 'ExternalApiKey'. Which approach correctly implements this HTTP call within a Power Automate flow called by the topic?
Select an answer to reveal the explanation.
Short Explanation
Bearer auth belongs in the Authorization header, so you initialize the environment variable into a flow variable and reference it in the HTTP action’s header. That keeps the token out of the URL and uses Power Automate’s supported dynamic header expression.
Full Explanation
REST APIs using Bearer token authentication expect an HTTP Authorization header in the format 'Bearer <token>'. Power Automate's HTTP action fully supports custom headers with dynamic expression values. The correct approach is to use the HTTP action in Power Automate with Method: GET, initialize a string variable named 'ApiKey' using an 'Initialize variable' action, set its value to the environment variable reference, and then add a header with Name = 'Authorization' and Value = 'Bearer @{variables('ApiKey')}'. This correctly constructs the Authorization header with the Bearer token format. The flow receives the API key from the Power Platform environment variable, which is the secure, configuration-managed location for such values. The approach that pastes the API key directly into the HTTP action's URL as a query string parameter is incorrect. Placing an API key in the URL query string is a security anti-pattern. URL parameters appear in server logs, browser history, and HTTP access logs in plain text. Bearer tokens specifically go in the Authorization header to keep them out of URL logs. The approach that uses the Custom Connector wizard to configure Bearer token authentication and then uses that connector action instead of a raw HTTP action is incorrect for this scenario. Creating a custom connector for a one-off API call is overkill. Custom connectors are valuable for APIs used across multiple flows and agents, but for a single flow making one API call, the HTTP action is appropriate. The question also asks about HTTP action implementation. The approach that stores the API key in the Copilot Studio agent's properties and references it using System.ApiKey in the HTTP header is incorrect. Copilot Studio agent properties and System variables are designed for conversation context, such as user info, session data, and channel info, not for storing API credentials. There is no System.ApiKey in Copilot Studio's variable system.