A Copilot Studio topic needs to call an external REST API that requires Bearer token authentication. The API key is stored as an environment variable named 'ExternalApiKey'. Which approach correctly implements this HTTP call within a Power Automate flow called by the topic?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Bearer auth goes in the Authorization header — use Power Automate's HTTP action, initialize the key from the environment variable into a flow variable, and reference it in the header expression. Answer: A.
Full explanation below image
Full Explanation
REST APIs using Bearer token authentication expect an HTTP Authorization header in the format 'Bearer <token>'. Power Automate's HTTP action fully supports custom headers with dynamic expression values.
Option A is correct. In the Power Automate flow, the developer first initializes a string variable ('ApiKey') using an 'Initialize variable' action and sets its value to the environment variable reference. In the HTTP action, under Headers, they add: Name = 'Authorization', Value = 'Bearer @{variables("ApiKey")}'. This correctly constructs the Authorization header with the Bearer token format. The flow receives the API key from the Power Platform environment variable, which is the secure, configuration-managed location for such values.
Option B is incorrect. Placing an API key in the URL query string is a security anti-pattern. URL parameters appear in server logs, browser history, and HTTP access logs in plain text. Bearer tokens specifically go in the Authorization header to keep them out of URL logs.
Option C is incorrect. Creating a custom connector for a one-off API call is overkill for this scenario. Custom connectors are valuable for APIs used across multiple flows and agents, but for a single flow making one API call, the HTTP action is appropriate. The question also asks about HTTP action implementation.
Option D is incorrect. Copilot Studio agent properties and System variables are designed for conversation context (user info, session data, channel info) — not for storing API credentials. There is no System.ApiKey in Copilot Studio's variable system.