API Keys are passed in headers, cookies or query parameters to access APIs. Those keys can be eavesdropped, especially when they are passed in the URL as logging or history tools will keep track of them and potentially expose them.
OWASP API2 2023 No API Keys in URL
Message: API Key MUST NOT be passed in URL (path or query parameters).