Why API Keys Should Not Travel in URLs
Keep API credentials out of query strings, browser history and routine logs, using the service’s supported authorisation mechanism and safe redaction.
Overview
When translating these concepts into an integration, keep the scope described by the wallet history api with the result. The examples in wallet transaction history and smart contract event logs show how the same distinction affects neighbouring data questions.
URLs are widely copied, cached and logged. Placing a reusable API key in a query string increases the number of places where it can leak, even when the request itself uses HTTPS.
Use the documented credential channel
Prefer the service’s intended authorisation header or another supported secure mechanism. HTTPS protects transport but does not erase URLs from application logs, browser history or monitoring systems. Redact secrets at collection boundaries rather than assuming every downstream log viewer will remember to hide them.
Worked example: a shared troubleshooting link
A developer copies a failing request URL into a ticket. If the key is embedded in the URL, the ticket now contains reusable access. A header-based request can still leak through careless logging, but it avoids turning an ordinary navigable link into a credential bundle. Use safe request identifiers for support instead.
Check all diagnostic paths
Test reverse-proxy logs, error messages, analytics and exported request examples. Never print complete headers during routine connection tests. If a credential has leaked, replacing the visible link is not sufficient: rotate and revoke according to the service’s supported process. Keep documentation examples explicitly non-secret and nonfunctional.
A practical acceptance test
Send synthetic credentials through the intended request path and inspect proxy logs, client exceptions and support output. The reusable value must appear nowhere in URLs or diagnostics. Add a nested error containing request configuration to verify redaction at the boundary. Safe correlation IDs should still allow the failure to be investigated without copying a credential.
Questions about the topic
Frequently asked questions
Does HTTPS make a query-string key safe to share?
No. The URL can still be recorded and copied outside transport.
Can headers also leak?
Yes. Logging and diagnostic tooling still need redaction controls.
Standards & technical documentation
