fix break by transmitting secret in URL instead of headers params