---
title: "Keep secrets out of addresses · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security/no-secrets-in-urls
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep secrets out of addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [API security](https://agentwranglers.se/playbook/api-design/api-security)
- Rule: Never put tokens, keys or personal data in paths or query strings. Send them in headers or the body.
- How: Addresses end up in logs, browser history and `Referer` headers. Reject API keys in query strings outright, so nobody starts relying on them. The same applies to personal data, as [personal data out of URLs](https://agentwranglers.se/playbook/website/privacy/personal-data-out-of-urls) explains.
- Check: Call an endpoint with `?api_key=...`. The answer is 400 or 401, and no log line holds the key.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/no-secrets-in-urls`.

- Previous: [Authorise every object](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation)
- Next: [Store API keys as hashes](https://agentwranglers.se/playbook/api-design/api-security/api-keys)
- [API security](https://agentwranglers.se/playbook/api-design/api-security)