Agent Wranglers

API security Required

Keep secrets out of addresses

Never put tokens, keys or personal data in paths or query strings. Send them in headers or the body.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Addresses end up in logs, browser history and Referer headers. Reject API keys in query strings outright, so nobody starts relying on them. The same applies to personal data, as personal data out of URLs explains.

How to check

Call an endpoint with ?api_key=.... The answer is 400 or 401, and no log line holds the key.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/no-secrets-in-urls.