Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-08 10:26:52 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Promote security knowledge from community to Microsoft layer

Browse source 
Pure git-mv relocation of the SECURITY domain from the community layer to the Microsoft layer. No content changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Jesper Schulz-Wedde 2026-06-25 14:03:22 +02:00
parent 3769d2fbf4
commit 347984ac74
16 changed files with 0 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md Normal file
View file

@ -0,0 +1,28 @@
---
bc-version: [all]
domain: security
keywords: [oauth2, api-key, authentication, httpclient, token-refresh]
technologies: [al]
countries: [w1]
application-area: [all]
---
# Prefer OAuth2 over API keys for external HTTP calls
> Contributions welcome — open a PR to refine or extend this article.
## Description
External HTTP integrations from AL can authenticate using OAuth 2.0 (client-credentials for service-to-service, authorization-code for user-delegated), API keys, basic authentication, or credentials in URLs. The mechanisms differ substantially in the blast radius of a leaked secret and in how cleanly tokens can be rotated. OAuth-issued tokens expire on their own schedule and rotate cleanly; API keys and basic-auth passwords typically have to be rotated manually and usually live unencrypted in a configuration table. When the partner supports OAuth, the difference is a material security improvement, not a stylistic preference.
## Best Practice
When the partner supports OAuth, use the platform `OAuth2` codeunit (`AcquireTokenWithClientCredentials` for service-to-service, `AcquireAuthorizationCodeTokenFromCache` for user-delegated flows) rather than hand-rolled token acquisition. Carry tokens and client secrets as `SecretText`, persist them only in IsolatedStorage, and refresh tokens proactively — on a buffer before the documented expiry — so routine calls never block on a token refresh.
See sample: `prefer-oauth2-over-api-keys-for-external-http-calls.good.al`.
## Anti Pattern
Accepting an API-key or basic-auth integration because it is the first option documented, even when the partner supports OAuth. The shared secret usually ends up in a setup-table `Text` field, rotation becomes a manual operation that rarely happens, and a single disclosure exposes every tenant using the extension.
See sample: `prefer-oauth2-over-api-keys-for-external-http-calls.bad.al`.