# Private API / Authentication for Data Sources

**URL:** <https://forum.builder.io/t/private-api-authentication-for-data-sources/658>\
**Category:** Technical Questions\
**Created:** [May 21, 2021, 10:22am UTC](https://forum.builder.io/t/private-api-authentication-for-data-sources/658 "2021-05-21T10:22:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jballo](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jballo](https://forum.builder.io/u/jballo)\
**Post date:** [May 21, 2021, 10:22am UTC](https://forum.builder.io/t/private-api-authentication-for-data-sources/658/1 "2021-05-21T10:22:20Z")

</div>

I was wondering if the Data Sources feature of Builder can be used with private APIs, that require authentication headers for example? If so, how would this work?

I’m wondering for a couple APIs that use an `Authorization` header with a `Bearer <token>`, and for another that uses a custom header. I’m also curious if it would be able to do anything dynamic to fetch a token to be used?

---

<div class="post-metadata">

**Author:** ![kara](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.builder.io/kara/32/80_2.png) [@kara](https://forum.builder.io/u/kara)\
**Post date:** [May 21, 2021, 6:51pm UTC](https://forum.builder.io/t/private-api-authentication-for-data-sources/658/2 "2021-05-21T18:51:39Z")

</div>

Hi @jballo, thanks for reaching out! You can achieve this using advanced data fetching + a bit of custom javascript. [This guide](https://www.builder.io/c/docs/guides/advanced-data) should help point you in the right direction. Let me know if you have any additional questions!

---

<div class="post-metadata">

**Author:** ![jballo](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jballo](https://forum.builder.io/u/jballo)\
**Post date:** [May 24, 2021, 8:47pm UTC](https://forum.builder.io/t/private-api-authentication-for-data-sources/658/3 "2021-05-24T20:47:05Z")

</div>

Hi Kara, thanks for that link. I think the info in that post gets me most of the way there. However, I’m unsure about what parts of a request I can get access to. I’m unsure about putting sensitive data into the URL / path, like a token. Is it possible to access a request header on the builder side? Or are there any best practices to recommend for this case?

---

<div class="post-metadata">

**Author:** ![maddy](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.builder.io/maddy/32/11_2.png) [@maddy](https://forum.builder.io/u/maddy)\
**Post date:** [May 27, 2021, 4:44pm UTC](https://forum.builder.io/t/private-api-authentication-for-data-sources/658/4 "2021-05-27T16:44:29Z")

</div>

Hi @jballo,

This is possible by using fetch. [The guide](https://www.builder.io/c/docs/guides/advanced-data#custom-javascript) Kara mentioned above should help point you in the right direction.

We wouldn’t recommend putting any sensitive token/bearer token inside of that code since that might be sent to the user’s browser and evaluated there. One option you could try is to ensure that you use only server side rendering or the HTML API (this will evaluate that code only on our servers).