HTTP request safety

[bssienes]

Hi,

I created a HTTP request as shown in the screenshot below.

Is it safe to use my username and password for authentication in a power automate?

[barret]

The answer to that would be: it depends. If you're just creating the flow for yourself and you aren't going to share the flow with anyone else, then yes, it is fairly safe to include those credentials in the flow as only you or a system admin have access to a flow you create for yourself. However, if you export that flow or share it with anyone, they will have access to whatever you stored in that HTTP request action, including those credentials, as they are stored as plain text in the exported file and anyone who imports it into their own environment will be able to see what you put in there as well.

[bssienes]

Thanks @barret 

Is there a way to import&export the text I am using to Power automate flows?

[barret]

You'd have to be more specific with what you're trying to accomplish. I see from your screenshot you're connecting to the Stripe API. There is a connector available for Stripe for Power Automate. If the connector has the functionality you're looking for, you should use that and not the HTTP request action. When you use connectors in Power Automate, the credentials are stored securely and are not available to anyone else and do not get exported or shared if you share the flow with someone else (when they import or use it, they have to provide their own credentials for the connector).

https://learn.microsoft.com/en-us/connectors/stripe/ 

[bssienes]

Unfortunately the Stripe connector doesn't have the action I am looking for. That's why I used a HTTP request.

[barret · Accepted solution]

What I would recommend then is creating a custom connector for the function you're missing on the regular connector. That would allow you to securely share that custom connector without revealing your credentials in the HTTP action.