# API Key Exposed in URL

> Detects API keys and tokens passed as URL query parameters, which are logged in server logs, browser history, and Referer headers.

- Skill: `zakirkun/api-key-exposed-in-url` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/api-key-exposed-in-url`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/api-key-exposed-in-url/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/api-key-exposed-in-url

---


# API Key Exposed in URL

## Overview
API keys in URL query parameters appear in:
- Server access logs (nginx, Apache, CloudFront)
- Browser history
- Referer headers sent to third-party analytics
- Shared URLs (when users copy the URL from their browser)
- Proxy logs and CDN access logs

## Remediation
- Pass API keys in HTTP headers: `Authorization: Bearer <token>` or `X-API-Key: <key>`
- Never log or store full URLs with API keys
- Rotate any keys that appeared in URLs