Inaccuracy in reasoning for using headers as API key transport as opposed to query string

[ndavison]

Hi there, the standards mention this:

API keys MUST NOT be included in the URL or query string. API keys MUST be included in the HTTP header (as query strings are not encrypted by TLS - headers are.)

While it's probably not a bad idea given web server logs often do keep records of a request's query string, this is not correct, as TLS happens at the transport layer and will encrypt everything in a HTTP request (method, query string, request URI, headers, body).