# query_token_not_allowed

> The API key was sent in the URL of a REST request; keys in the URL are accepted only for WebSockets.

Source: https://tickwire.io/docs/errors/query_token_not_allowed/

HTTP 401. Nothing reached the broker.

**Likely cause:** A REST call carried ?api_key= or ?auth-token= in its query string. URLs end up in logs, browser history and proxies.

**What to do:** Send the key in the X-API-Key header (or auth-token, or Authorization: Bearer).

**Retry:** No. The same request gets the same answer; change something first.

Listed under [Keys, tokens and permissions](https://tickwire.io/docs/errors/#keys-tokens-and-permissions) in [Errors](https://tickwire.io/docs/errors/). Send the error's `requestId` to support and we can find the request.