Never Put MCP Access Tokens in URLs
The MCP authorization specification explicitly requires bearer tokens to be sent through the Authorization header and forbids putting access tokens in URI query strings.
Why URLs are risky
URLs are frequently captured in reverse-proxy logs, analytics, browser history, monitoring systems, screenshots, and referrer-related telemetry.
Correct pattern
Authorization: Bearer <access-token>
Also redact logs
Even headers can leak if you log entire request objects. Configure redaction for authorization headers and sensitive metadata.