![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 51%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA0%3C/text%3E%3C/svg%3E)
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 16%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERG%3C/text%3E%3C/svg%3E)
Hello @AlejandroBenitez-0092,
The warning in the Microsoft documentation is cautioning against including sensitive information or secrets directly in the custom widget code because the code is stored in public Azure blob storage that can be accessed without authentication. This means that anyone with the endpoint can potentially view the code, including any hard-coded secrets.
To address this, you can create a custom widget that includes a configuration setting for the client and secret, rather than hard-coding them directly into the code. By allowing these values to be set dynamically through configuration settings, you can avoid exposing sensitive information in the code itself.
The warning primarily refers to the widget code stored in the public Azure blob storage. However, it's essential to ensure that any configuration values or settings that are stored alongside the code are also handled securely. While the configuration values may not be as easily accessible as the code itself, it's still best practice to avoid storing sensitive information in an insecure manner.
If you need to access a secured API, such as a custom API virtualized via Azure API Management or a secured App Insights instance, you can consider using the connected user's authentication token for authentication. This approach would involve leveraging the authentication mechanisms provided by Azure AD, such as B2B/guest accounts, to authenticate and authorize access to the secured APIs based on the user's permissions.
By utilizing authentication tokens and proper authorization mechanisms, you can ensure that access to secured APIs is controlled and restricted to authorized users, enhancing the security of your custom widget and interactions with secure APIs.
Kindly refer below link:
Extend the developer portal with custom widgets
If you find the answer helpful, kindly click "Accept Answer" and upvote it. If you have any further questions or concerns, please feel free to reach out to us. We are happy to assist you.