# Why tokens aren’t in URLs

A runner URL like `/run/bot_abc` is safe to bookmark, screenshot, and paste. A URL like `/run/bot_abc?token=Bot%20MTk…` is a leak:

- Browser history
- Crash reports
- Referrer headers
- Shoulder surfing
- `pm2 logs` / reverse-proxy access logs if you self-host poorly

TabBot therefore:

1. Opens `/run/:botId` with **no** search string
2. Sends the token **and named-secret bag** over `postMessage` / `BroadcastChannel` after a nonce handshake
3. Holds a copy in the runner’s `sessionStorage` until the tab dies

Named secrets (`llm/apiKey`, `translation/apiKey`, anything you add in Settings) follow the same rule: not in URLs, share codes, git, or Discord. See [Named secrets](/docs/guide/named-secrets).

If you ever see `token=` on a TabBot URL, stop, rotate the Discord token, and file a bug. Do not send the leaked token to HoneyPeer.

Invite URLs use `client_id` and `permissions` only. That is not a bot token.