What account should be used for API with query parameter authentication?

[Andrei_Y]

I have two source TikTok Business and Semrush APIs which use query parameter authentication. I didn't find an appropriate account which I can use for HTTP Client. I don't want to keep secrets in files or pipeline parameters. Maybe I missed something, any ideas on that?

[ddellsperger · Accepted solution]

For TikTok Business, you'll want to use an OAuth2 Account (using the /oauth/token endpoint for the token collection) then you can add the custom header and reference the account's access token with account.access_token it will still be obfuscated in logs and details that we return back to you throughout the course of processing.

For Semrush, you'll want to use the Secured Headers Account and while it will still put those headers into the request, Semrush SHOULD ignore them (I don't see anything that indicates otherwise), you can put the header in the Additional Auth Headers section with they key being key and value being your `API_KEY`, then you can refer to the key as account.key similar to the OAuth2 account. How you refer to it is how it's set up in your account, so if you use API_KEY as the key, you'll need to refer to it as account.API_KEY.

[Andrei_Y]

Thanks! It works. I tested Secured Headers Account for both because the TikTok API request requires app_id and secret query parameters in addition to the Access-Token.