Hi @RamyEdrees,
to be clear: this is a dirty workaround because the (secret) API key must be provided as input to an action. One could improve this using Azure key vault, but I have not done that yet.
Here a few screenshots:
Authentication type remains empty:

I implemented the function to generate the token manually:

I specified two policies. One policy rewrites the "Origin" header (required by the external API I intend to use). In my case this policy must be applied also when generating the token:

The second policy rewrites the "Authorization" header for every subsequent call after the token generation:

Depending on the requirements of the external API that you intend to use, these policies may have to look different.
An example flow would look like this:

HTH.