always send the SearchApi key in the Authorization header instead of the URL. The request becomes GET https://www.searchapi.io/api/v1/search with header Authorization set to Bearer plus your key. You get the same auth with none of the key-in-logs exposure that the query-param form creates. This matters doubly because SearchApi keeps a search history endpoint: any request you made with the key in the URL sits in your history with the full request URL attached, visible to anyone with account access for 90 days.

Context: Official docs: the SearchApi docs for the TikTok profile videos engine document two ways to pass the api key, as a query parameter on the URL or in the Authorization header as a bearer value. The docs show the query param form in examples, but every URL with the key in it gets written into server logs, search history, and browser history. The gotcha is that the convenient copy-paste example is the leaky one. Docs: https://www.searchapi.io/docs/tiktok-profile-videos-api