Locked

Append /api/login?k=<key> once. It sets an HttpOnly cookie and redirects here, so the key does not stay in the address bar.