A Copilot Studio agent uses a custom connector to call a third-party weather service API that requires an API key passed as a query string parameter named 'apikey'. The developer must configure authentication for this connector so the API key is automatically appended to every request without exposing it in the topic designer or to end users. Which authentication type and configuration correctly implements this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The API Key authentication type in a custom connector is like a magnetic hotel key card programmed into the door lock — the guest (user) never sees it and never needs to carry it. It's attached automatically at the connector layer, invisible to topics and users, exactly where credentials belong.
Full explanation below image
Full Explanation
Custom connectors in Power Platform (which Copilot Studio agents use for HTTP-based external service calls) support a dedicated 'API Key' authentication type. When configured, this authentication type automatically appends the API key to every request made through the connector — either as a query string parameter or in a header — without requiring any explicit handling in the topic designer or Power Automate flow that uses the connector.
The configuration requires: setting authentication type to 'API Key,' specifying the parameter name ('apikey'), setting the location to 'Query,' and providing the key value at connection creation time (when a user or system administrator creates a connection to this connector). The key is stored encrypted in the connection record and is never visible in the topic canvas or to conversation users.
Option B is incorrect because Basic authentication sends credentials in an Authorization header formatted as Basic {base64(username:password)}. This is a different authentication scheme than a query string API key. While technically some APIs accept both, using Basic auth when the API expects a query parameter named 'apikey' would not work and misrepresents how the API expects to receive authentication.
Option C is incorrect because hardcoding API keys in topic variables is a serious security anti-pattern. Variables in the topic designer are visible to all developers with access to the agent, may be logged in conversation traces, and cannot be rotated without modifying the topic. This approach violates credential security principles.
Option D is incorrect because Copilot Studio environment variables are not natively accessible via {System.EnvironmentVariables.xxx} syntax in connector action calls within topics. Environment variables in Power Platform store configuration values for flows and canvas apps, but they don't automatically inject into connector authentication headers or parameters. Even if accessible, this approach would still expose the key in the topic designer.
Exam tip: API key authentication is connector-level configuration, not topic-level. The security principle is that credentials should be stored and applied at the infrastructure layer, invisible to application logic.