owasp-no-api-keys-in-url

Keep API Keys out of paths and query parameters!

API Keys are (usually opaque) strings that are passed in headers, cookies or query parameters to access APIs. URL credentials can appear in logs, browser history, and copied links. The rule reports API-key security schemes with in: query or in: path. OpenAPI permits API keys in headers, cookies, or query parameters; in: path is invalid OpenAPI as well as a finding here.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  securitySchemes:
    "APIKeyInQuery":
      type: apiKey
      name: api_key
      in: query
    "APIKeyInPath":
      type: apiKey
      name: api_key
      in: path
paths: {}

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  securitySchemes:
    "APIKeyInHeader":
      type: apiKey
      name: X-API-Key
      in: "header"
paths: {}

How do I fix this violation?

Remove credentials from URL visible parameters, like query and path parameters.