What you should actually do is use short lived authorization tokens (maybe 30s, clamped by the user agent) derived from a longer lived session secret. You can e

What you should actually do is use short lived authorization tokens (maybe 30s, clamped by the user agent) derived from a longer lived session secret. You can even bind the short lived request tokens individually to an IP since the client is doing it for each request. Macaroons make this rather simple. That way there’s no risk in sharing request logs.