Profile My skills Saved Collections Edit profile Submit a skill

API Key Exposed in URL

Detects API keys and tokens passed as URL query parameters, which are logged in server logs, browser history, and Referer headers.

zakirkun 0952003 2 files · 2.1 KB Updated
Integrations & APIs

File contents

API Key Exposed in URL

Overview

API keys in URL query parameters appear in:

  • Server access logs (nginx, Apache, CloudFront)
  • Browser history
  • Referer headers sent to third-party analytics
  • Shared URLs (when users copy the URL from their browser)
  • Proxy logs and CDN access logs

Remediation

  • Pass API keys in HTTP headers: Authorization: Bearer <token> or X-API-Key: <key>
  • Never log or store full URLs with API keys
  • Rotate any keys that appeared in URLs

zakirkun/ice-tea/tree/main/skills/auth/api-key-in-url commit 095200378f

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/api-key-exposed-in-url