In Pass API_KEY via Authorization headers not URL
>but URL params aren't, and can't be.
Sorry to say, but this is false information.
The only thing available to man in the middle (like your provider) is host. Whole request is encrypted and is not available to any man in the middle without having their CAs installed.
This is actually the reason why in dictatorship states like russia dpi blocks the IP instead of uri if "forbidden materials" are behind https and only specific uri if http
Btw you can use dns over tls to make it completely invisible
>Using a credential in the URL is 100% against the standard
Basic auth works with credentials in the url and it is per standard. If torn used basic auth, say with pair USER and PASSWORD, I would be able to login with https://USER:PASSWORD@www.torn.com/ as url. Must add that it will be transformed into a header. But still, credentials in uris are completely valid and per standard
Sorry to say, but this is false information.
The only thing available to man in the middle (like your provider) is host. Whole request is encrypted and is not available to any man in the middle without having their CAs installed.
This is actually the reason why in dictatorship states like russia dpi blocks the IP instead of uri if "forbidden materials" are behind https and only specific uri if http
Btw you can use dns over tls to make it completely invisible
>Using a credential in the URL is 100% against the standard
Basic auth works with credentials in the url and it is per standard. If torn used basic auth, say with pair USER and PASSWORD, I would be able to login with https://USER:PASSWORD@www.torn.com/ as url. Must add that it will be transformed into a header. But still, credentials in uris are completely valid and per standard