Authorization Bearer in Header - Custom Connector

[rpiwetz]

I have created a custom connector that is connecting to a vendor's API.  I have unauthenticated GET methods working, but now am working on some POSTs and am running into an issue with putting "Authorization: Bearer token_value" in the header.  Even on the unauthenticated GET calls, I can see in the request header that "Authorization: Bearer some_token_value" is already there.  I've tried setting the Header in my POST call, but then I get the error: "Message": "Error from ASE: Bad authorization header scheme".

I can see that the request header has my token_value and so it appears I'm not allowed to set the header that way.  What is the right way to send my "Authorization: Bearer token_value" to the API?

Thank you.

[alexco]

I have the same issue, did you solve it in the meantime?

[rpiwetz]

I ended up opening a ticket with Microsoft, went back and forth with them a few times, but they never seemed to understand the issue no matter how many times I explained it, so I've had to give up for now.

[kmsFG19]

 Facing the same problem - MS should help us out here!! 

[rpiwetz · Accepted solution]

I've figured this out by learning about making an OpenAPI document describing the interface, and creating a custom connector off of the document.

1. On the Security tab, select "API Key" for the Authentication type
2. For "Parameter Label" put whatever you want someone to see when they are creating a Connection off of this Connector...I used "API Key"
3. "Parameter Name" should be "Authorization" (no quotes)
4. For "Parameter Location", select "Header"
5. When you create a Connection off of this Connector, you'll be prompted for your "API Key" (or whatever you used for step 2 above)
6. Enter "Bearer YOUR_BEARER_TOKEN_VALUE" (no quotes)

This will pass your bearer token to the API successfully.

[alexco]

Nice, I will try this. However, this doesn't work with an expiring token.

[Anonymous]

This did not work for me. Actually nothing has to this point. I've tried encoded Basic authentication with api key and bearer token but still get 401 unauthroized.

[Anonymous]

This works for me as the admin-developer. However when sharing the app with end users, it forces them to enter the API Key to use the application.

Is it known if there is a way to work-around this functionality?

[keatklein]

The solution provided by rpiwetz worked for me, sort of.  I did need to add an "accept:application/json" header to the defenition first though, otherwise I got a 401 error.

I said "sort of" above because I still cannot figure out a solution for an expiring token.  I can get this to work by population the connector with my expiring token, but then it only works for 1 hour.  Has anybody figured out a solution for an expiring token?

[DMum]

Same issue expirting token won't work with API Key. Any luck? Thank you!

[OttoVoss]

I'm facing the same challenge. Have some of you found a way to do it?

[keatklein]

I don't think it's possible if you have an expiring token.  I tried everything I could think of and never found a solution.

[Dinesh]

I found an interesting way to do this. In my case the token expires in 24 hours. So I create a seperate flow which runs every 24 hours to update the new token. Steps in the new flow

1. Trigger to run every 24 hours
2. HTTP request to the Authentication endpoint to generate new token
3. Create connection action in Flow management to create a new connection for the custom connector with the token generated in the previous step
4. Get Flow action to fetch the details of the actual flow
5. Update Flow action to update the new connection to the flow

Now every 24 hours new connection is created and used by the flow. It works for me. But i would like to have a Edit connection action which would be more helpful. Please vote for this idea.

https://powerusers.microsoft.com/t5/Flow-Ideas/Edit-connection-in-Flow-management-connector/idi-p/35...

[quihan]

Hi @Dinesh, just wondering how are you updating your flow with a new connection? I tried using the Update Flow action to update the "connection reference" with the ID and Name created by the Create Connection Action. It works for the first run. But when I refresh my flow, the custom connectors result in a "connector not found" error.

Cheers,

Qui

[paulstegmann]

Hi @Dinesh ,

i just followed your steps, but i dont know what i have to put in Flow Display Name and Flow Definition.

Thanks in advance!

Paul

[russrimm]

I'm also unsuccessfully attempting to figure out how to get this working using all the old responses and this thread.  I have a Bearer token that expires every 15 minutes and a refresh token that expires every 24 hours.  How do I get and pass these back to my custom connector to be used by my PowerApp?  I'm able to do a Return to PowerApps to get the data back to the app but i'm having to make my flow do all the HTTP calls based on switches and variables and it's painful so i'd prefer to use a custom connector.

[paulstegmann]

Hi,

meanwhile i found a proper solution. I realized the connection without any custom connectors. You just have to take the HTTP integration (directly in the flow) and make a POST to get the API token instantly. Create a HTTP GET step and use the token from above.

Best

Paul

[DaveLaid]

Brilliant @paulstegmann !  This solution worked perfectly for a custom REST API I was dealing with.  Thank you!

[clh]

Ugh, yes, the solution given is worthless for an expiring token.  I need to be able to pass the token as a parameter to the action, not have the token be embedded in the "connection."

I tried adding the Authorization header as a header in the custom connector action definition, but the custom connector editor won't let me.  It gives an error and says to use the API Key solution mentioned here, which again, won't work.

I know I can accomplish what I need with a standard Power Automate using the HTTPS connector, but that's going to take SO much more coding!

[Yoshi1]

In your queries, create a header named "access-token" (to put your token in)

Create a policy as following and apply it to your requests ("operations" field) requiring authentication. It will replace the headers "access-token" by "Authorization"