What is the best way to store a barer token securely in NS? I tried using a secure string, but it's not replacing it with the token when included in the authorization header. As a (temporary) workaround I'm passing the token as a company parameter in the scheduled script.

what did your attempt at using a secure string look like

const bearerToken = https.createSecureString({
            input: `Bearer {custsecret_openai_api_key}`
        });
        
		const response = https.get({
			url: `${url}`,
			headers: {
				'Content-Type': 'application/json',
				// biome-ignore lint/style/useNamingConvention: Authorization header
				Authorization: bearerToken,
			},
		});

Response: esponse code: 401, body: { "error": { "message": "Incorrect API key provided: {custsec***************key}.

make sure that the api secret has the

Restrict To Scripts

field correctly set to your script's script id

I just got it working. I wish it would raise an error if you attempt to use a secure string on a script/domain that is not on the whitelist. In my case I assumed x.domain.com would be allowed if domain.com was allowed.

I’m using a more direct approach.

const resp = <http://https.post|https.post>({
  url: `${url}`,
  body: JSON.stringify(payload),
  headers: {
    'Content-Type': 'application/json',
    Accept: '/',
    Authorization: 'Bearer {custsecret_apikey}',
  },
  credentials: ['custsecret_apikey'],
});

I don't see how that's more direct. In fact, I'd call it less direct because you had to refer to the

custsecret

twice. On the other hand, Christopher is doing a GET and you're doing a POST so it's not apples/apples anyway. just sayin'