I don’t see that URN gets you anything. You’d be registering a namespace identifier for it, so it’d end up just being the difference between urn:secret-token:*

I don’t see that URN gets you anything. You’d be registering a namespace identifier for it, so it’d end up just being the difference between urn:secret-token:* and secret-token:*. Does the extra “urn:” help with anything? Doesn’t seem so to me.