owasp-no-api-keys-in-url

Keep API Keys out of paths and query parameters!

API Keys are (usually opaque) strings that are passed in headers, cookies or query parameters to access APIs. Those keys can be eavesdropped, especially when they are stored in cookies or passed as URL parameters.

Bad example

openapi: "3.1.0"
info:
  version: "1.0"
components:
  securitySchemes:
    "APIKeyInQuery":
      type: apiKey
      in: query
    "APIKeyInPath":
      type: apiKey
      in: path

Good Example

openapi: "3.1.0"
info:
  version: "1.0"
components:
  securitySchemes:
    "APIKeyInHeader":
      type: "APIKey"
      in: "header"

How do I fix this violation?

Remove credentials from URL visible parameters, like query and path parameters.