A Copilot Studio solution must call a partner REST API that authenticates with an API key in a custom HTTP header. The team uses a Power Automate HTTP action (or custom connector) invoked from a topic. Where should the API key be stored for production?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Secrets belong in vaults and secret environment variables — not in chat messages, display names, or knowledge PDFs that anyone might retrieve.
Full explanation below image
Full Explanation
API keys are secrets. Power Platform guidance is to use secret environment variables (Key Vault integration patterns) or secure custom connector authentication configuration, never user-visible content.
Option A is correct.
Option B exposes the secret to end users and transcripts.
Option C is not a secret store.
Option D may surface secrets via retrieval and is an anti-pattern.
Exam tip: Secret env vars / Key Vault + connection auth settings; rotate keys without rewriting topics.