Why should a BYOK tool never put the key in a shareable project URL?

A URL can appear in browser history, logs, screenshots and copied links. Keep user-provided credentials out of that state. Store or transmit them only through the intended secure boundary, with a clear retention policy, and never include them in analytics events.

Separate reusable project settings from authentication material. A shared brief can preserve model preferences and creative inputs without carrying the credential that paid for the original run. Reopening a project should not silently grant another person access to a provider account.