Updating messaging bots to use secure API connections for API calls

Starting May 31, 2023, you can only use API connections to authenticate REST API calls from a messaging bot. A messaging bot can make REST API calls using Flow Builder's Make API call step.

Before the release of API connections, admins could authenticate REST API calls from a messaging bot by passing credentials in request headers. API connections are a more secure, convenient way to store these credentials.

This article walks you through the process of updating your messaging bots to use API connections. The article contains the following topics:

• Disallowed authentication headers
• Updating the Make API call step to use connections

Disallowed authentication headers

After May 31, 2023, Make API call steps that include authentication-related headers will automatically fail. These include the following headers:

• authorization
• x-api-key
• x-api-token

If a Make API call step fails, the conversation follows the step's API call failed branch.

Updating the Make API call step to use connections

To avoid disruptions, create API connections to store any API credentials used by your messaging bots. Then update any related Make API call steps in each bot's answers to use API connections for authentication.

To update a Make API call step to use an API connection

1. If an API connection doesn't already exist for the credential, create one in Admin Center. See Creating API connections for Flow Builder.

   You can use the same API connection across several bots and Make API call steps.

2. On the Answers tab of the bot’s edit page, click Edit to access Flow Builder for the answer.
3. In Flow Builder, click the Make API call step.
4. In the step, use the Authentication drop-down to select the related API connection.

   

5. Under Headers, delete any authentication-related headers.

   

6. Click Make API call to test the API call using the API connection's credentials.
7. Click Done in the upper right corner of Flow Builder.
8. Publish the bot to deploy your changes.