While configuring an HTTP action for a Copilot Studio agent to call a third-party REST API, you need to pass an API key in the request header. The key must not be visible to agent authors in plain text. Which authentication configuration should you use?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Storing secrets in plain text is like writing your house key on the front door — convenient but catastrophic. Power Platform environment variables of type Secret are encrypted at rest and masked in the UI, making them the secure home for API keys referenced by HTTP actions.
Full explanation below image
Full Explanation
When configuring HTTP actions in Copilot Studio, credentials like API keys should never be stored or displayed in plain text. Power Platform environment variables support a 'Secret' type that encrypts the value using Azure Key Vault under the hood. Authors can reference the variable by name in HTTP action headers without ever seeing the actual key value.
Option A (plain-text topic variable) exposes the key to anyone with access to the topic editor and to conversation logs — a security anti-pattern.
Option C (hard-coded in UI) is the worst option — the key is visible to all Copilot Studio authors who open the action configuration and may appear in exported solution files.
Option D (no auth + IP allowlisting) is a network-layer control only. It doesn't protect the API if the allowlisted network is compromised and doesn't address the header-key requirement at all.
On the exam: Secret type environment variables are the correct mechanism for keeping API credentials masked in Power Platform / Copilot Studio. The variable is set once by an admin, and the HTTP action references it as a named variable. When the solution is exported, the secret value is not included — it must be set in each target environment separately, which is also good ALM hygiene.
Also recall: for OAuth-protected APIs, Copilot Studio supports OAuth 2.0 configuration directly in the HTTP action settings, which is preferable to API keys when the provider supports it.