Embedding the API key (secret) in the URL complicates secret management. Please move that to a header and allow setting via env var.