Tokens must only be placed in the Authorization request header and never in the URL, as doing so would cause them to be recorded in logs and leaked in plaintext.