Power Platform Community Forum Thread Details

A Power Automate flow that calls another flow via HTTP trigger around Saturday, 28 June 2026. No changes were made to the flows or calling configuration on our end. The error is:

{
"error": {
"code": "DirectApiRequestHasMoreThanOneAuthorization",

"message": "The request has SAS authentication scheme, 'Bearer' authorization scheme or internal token scheme. Only one scheme should be used.",
}
}

This is happening in default environment only.

Categories:

Building flows

That error is not something you broke. It means the request reaching the child flow is carrying two authentication schemes at once, and the HTTP trigger only accepts one. The two schemes are:

The SAS signature in the trigger URL (the sp, sv, and sig query parameters).
A Bearer/OAuth token in the Authorization header.

Microsoft has been tightening enforcement of the "only one scheme" rule and rolling it out environment by environment, which lines up with it suddenly appearing in the default environment with no change on your side.

Could be wrong, but I think you have 2 options:

Stay on SAS:

In the child flow's trigger, set "Who can trigger the flow" back to "Anyone".
In the calling HTTP action, make sure Authentication is set to None and you are NOT sending an Authorization header. Call the full SAS URL only.

Use OAuth (this is quite tricky):

Keep the trigger restricted to "Any user in my tenant" or "Specific users".
Call the flow with the Bearer token in the Authorization header, but strip the SAS query parameters (sp, sv, sig) off the URL. With OAuth enabled the signature must not be present.

If this is purely one flow calling another in the same tenant, the cleanest fix is to drop the raw HTTP call entirely and use the Run a Child Flow action instead. It invokes the child internally, so there is no SAS-vs-Bearer collision to manage.

References if they help (I wrote a lot about this):