Configure OpenAPI Security Scheme for API Key

AI-103 By islever Editorial Last updated

Build agents by using Foundry

Short answer

C Configure an API key security scheme in the OpenAPI specification to automatically inject the connection-stored key into the required HTTP header.

Question

You have a Microsoft Foundry project named Project1 that contains an agent. The agent uses an OpenAPI 3.0 specification to call an external weather service.
The weather service requires a key to be passed in an HTTP header. The key value is stored as a connection in Project1.
You need to ensure that the key value from the connection is included automatically whenever the OpenAPI tool is invoked.
What should you configure in the OpenAPI specification?
  1. a header parameter defined for each operation
  2. an Azure Key Vault connection
  3. an API key security scheme Correct Answer
  4. a Bearer token security scheme

Key Takeaways

Tests knowledge of OpenAPI security definitions; the trap is confusing generic header parameters or token-based schemes with the specific mechanism for passing a static connection-stored key.

Learn how to configure an OpenAPI specification in Microsoft Foundry to automatically inject a static API key into HTTP headers. This guide explains why the API key security scheme is the correct implementation for external service authentication.

Common mistake: Candidates often select 'a header parameter defined for each operation' (A), which requires manual value passing rather than automatic injection from a connection, or choose 'Bearer token' (D) assuming all auth is token-based.

Expert Analysis

Why the Answer Is Correct

The question requires the key value from a Foundry connection to be included automatically when the agent invokes the tool. In an OpenAPI specification, this is achieved by defining a securitySchemes section with type: apiKey. When this scheme is referenced in the security requirements, the Foundry runtime can map the stored connection secret to this scheme and inject it into the specified header (e.g., X-Weather-API-Key) without manual intervention per call.

Why the Other Options Are Wrong

Option A (header parameter for each operation) defines the schema but does not inherently provide an automated source for the value; it typically expects the caller to pass the value explicitly unless bound to a specific security scheme. Option B (Azure Key Vault connection) is a storage mechanism in Azure, not an OpenAPI specification construct for defining authentication requirements. Option D (Bearer token security scheme) uses type: http with scheme: bearer, which is designed for OAuth2/JWT flows where a token is generated or passed, not for a simple static API key passed in a custom header name.

Community Comment Notes

Community consensus strongly supports option C. One user noted that "The OpenAPI tool injects a connection-stored key automatically when the spec declares an API key security scheme," highlighting the automation aspect. Another comment provided the exact YAML snippet showing type: apiKey in: header, confirming the technical implementation details.

Exam Strategy

When configuring tools for agents in Foundry, always distinguish between defining a parameter's structure and defining its authentication source. Use apiKey security schemes for static credentials stored in connections to ensure automatic injection.

Frequently Asked Questions

Why not use a Bearer token for a simple API key?

Bearer tokens are for dynamic tokens (OAuth/JWT). API keys are static strings usually placed in a custom header, best handled by the apiKey type.

Does adding a header parameter automatically use my connection?

No. Defining the parameter only describes the request. You must link it to a security scheme so Foundry knows to fetch the value from your connection.

More AI-103 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. RICHARDALEX007 👍 1 Answered C
    The OpenAPI tool injects a connection-stored key automatically when the spec declares an API key security scheme (apiKey in header). A per-operation header parameter (A) would require passing the value manually, a Key Vault connection (B) is not an OpenAPI construct, and a Bearer scheme (D) is for OAuth/JWT tokens, not a static header key.
  2. Srikantha 👍 1 Answered C
    components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-Weather-API-Key # The header name expected by the service

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide