Hi,

I think it's a good practice that tokens should not appear in the URL, as this can be captured in (web, proxy) server logs, which makes them easily exploitable. Sensitive information must not be exposed through URL. Please make a change and force users to use the HTTP header to sent over the authtoken. Example (C#):