I have a PowerBI data-source that uses a simple token via HTTP request header for authentication. The data-source is ingested into a Fabric LakeHouse via a Fabric Notebook (PySpark) called from a Fabric Pipeline. I'm concerned about security of the token, which the Notebook has to use.

Since the token is not ephemeral (it must never leak), I don't want to simply hard-code it into the Notebook, even though access to the Notebook's Worspace is managed (leaks via git, logs, stdout, exceptions etc.). It appears to me that a better solution is to put the token into a Azure Key Vault, and retrieve it via notebookutils.credentials.getSecret() when the PySpark session needs it.

My question is wether this is secure, or just seems like it. As notebookutils.credentials.getSecret() uses the current user's credentials to authenticate against Key Vault, the user that executes the Notebook has to have access to the secret. If that is possible, we assume the user knows/copies/stores/can run away with the token anyway. Yet if another, future, user is granted access to the Workspace without access to the Vault, I don't see a way to leak the token, as long as the PySpark job does not leak it e.g. via logs; the best that user can do is run into an authentication error when accessing the Vault. Is that true?