Check your privacy rules. You should delete the API connector value or this will be used by default if blank (if you didn’t activate the blank checkbox). Your issue is probably more related to how you pass the value to the action. Try to check ignore privacy rules to validate if this is related to privacy. Be sure the user your are testing with have the token available. (Create a test page with a text that show the expression you have for header (Campaign’s parent customer’s portmask server token)