Allow api key query fallback

README.md

@@ -15,23 +15,23 @@ Tiny API that clones a Git repo and counts its non-empty lines of code.
 
 ## Endpoints
 
-- `GET /loc.txt?repo=<git-url>&ssh_key=<optional-key-file>&ref=<optional-ref>`
+- `GET /loc.txt?repo=<git-url>&ssh_key=<optional-key-file>&ref=<optional-ref>&api_key=<optional-api-key>`
   - Returns the line count as plain text.
-- `GET /loc?repo=<git-url>&ssh_key=<optional-key-file>&ref=<optional-ref>`
+- `GET /loc?repo=<git-url>&ssh_key=<optional-key-file>&ref=<optional-ref>&api_key=<optional-api-key>`
   - Returns JSON metadata, including a language breakdown by files and non-empty lines.
 - `GET /health`
   - Health plus queue/cache stats.
 
-You can also pass `query=<git-url>` as a compatibility alias for `repo`.
-This is considered unsafe and discouraged because the name is too generic and easier to misuse or collide with upstream tooling.
-Prefer `repo` unless you explicitly need legacy compatibility.
-
 ## Auth
 
 No auth by default. If `API_KEY` is set, send it as either:
 
 - `x-api-key: ...`
 - `Authorization: Bearer ...`
+- `api_key=...` query param
+
+The `api_key` query param is unsafe and discouraged because it can leak through logs, browser history, analytics, caches, and referrers.
+Prefer `x-api-key` or `Authorization` whenever possible.
 
 ## SSH keys