Securely storing and using API keys in Power Automate and SPFx without exposing credentials

Minhaj Maqsood 0 Reputation points
2026-09-15T07:53:20.5333333+00:00

Hi everyone,

I’m working on an SharePoint Online solution where I need to integrate Decibel APIs with a custom SPFx web part.

The current requirement is:

SPFx Web Part → Power Automate → Decibel API → Return data → SPFx Web Part

The Decibel API requires an API key for authentication.

My main concern is ensuring that the API key is never exposed to the client/browser or accidentally leaked through Power Platform execution history, diagnostic logs, or error messages.

Current requirement

The SPFx web part needs to display information retrieved from Decibel, for example:

  • Employee information
  • Leave/attendance information
  • Employee-related HR information
  • Other information available through the Decibel API

Security questions

I have several questions regarding the recommended Microsoft architecture for this scenario:

1. Where should the Decibel API key be stored?

What is the recommended secure storage mechanism for an API key used by a Power Automate flow?
NOTE: I don't have Azure Subscription. If there is any other solution other than Azure KeyVault please let me know.

For example:

  • Power Platform environment variables
  • Connection references
  • Custom connectors
  • Other recommended mechanism

2. How should Power Automate retrieve and use the secret?

3. Can the API key be prevented from appearing in Flow Run History?

should Secure Inputs / Secure Outputs be enabled on specific actions?

Are there any limitations or caveats with using Secure Inputs/Outputs for this scenario?

4. What about diagnostic logs and error messages?

Suppose the Decibel API returns an error, or Power Automate encounters an HTTP error.

How can I ensure that the API key does not accidentally appear in:

  • Error messages
  • HTTP request/response details
  • Power Automate diagnostics
  • Application Insights / Azure diagnostics, if used
  • Connector logs

Are there specific practices recommended for sanitizing errors and responses?

5. How should SPFx call the flow securely?

Is using a Power Automate HTTP-triggered flow as a backend/proxy for the Decibel API an appropriate architecture?

The requirement is primarily retrieving data from Decibel and displaying it in an SPFx web part, also to update or POST data to decibel.

I would appreciate guidance on the Microsoft-recommended architecture and security pattern for this scenario, particularly from anyone who has implemented API integrations with SharePoint/SPFx and Power Platform in an enterprise environment.

Thanks.

Microsoft 365 and Office | SharePoint | For business | Windows
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Helen Luu 2,865 Reputation points Independent Advisor
    2026-09-15T10:25:37.8733333+00:00

    Hello @Minhaj Maqsood

    Since your scenario involves integrating Power Automate with the Decibel API, I recommend posting your question in the Microsoft Power Platform Community Forum Thread. This platform is specifically dedicated to Power Automate and is supported by a knowledgeable group of experts and partners who regularly contribute and share insights. 

    Microsoft Power Platform Community Get involved v Get answers v Discover events Learn Power Platform v Search Q Post a question Power Platform Community / Forums / Power Automate Power Automate

    I suggest creating a new topic in the Power Automate Community rather than posting in the Microsoft Answers forum. The Answers forum primarily focuses on Microsoft 365-related concerns and has limited resources and expertise in Power Automate. By posting in the correct community, you’ll likely receive quicker and more precise guidance.

    However, I found some information that could be helpful for your scenario. You should enable both Secure Inputs and Secure Outputs in your flow to prevent sensitive information from being exposed in the run history, logs, or audit records. This helps enhance the privacy and security of your data. For more details, please refer to Secure data used in cloud flows - Power Automate | Microsoft Learn

    Regarding the HTTP response details when an error occurs, Power Automate typically captures and displays the error response returned by the Decibel API. Therefore, I recommend checking with the Decibel API support team to confirm whether their error responses may contain sensitive information, such as API keys or other confidential data. This will help you determine whether additional measures are needed to protect sensitive information within your flow.

    Thank you so much for your understanding.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.