A REST API uses API keys for authentication. The API gateway logs include: 'GET /api/data?api_key=sk-live-abc123'. A security team spots this. What is the immediate action and the architectural fix?

• A.Immediately revoke and rotate the exposed key; it has been logged in plain text in server logs, proxy logs, and potentially CDN/monitoring systems. The architectural fix: API keys must be sent in the 'Authorization: Bearer' header (or a custom header) - headers are excluded from server access logs by default, unlike URL query strings
• B.Immediately block the calling IP at the WAF; the key sits in a single log line (the one the team spotted), and rotation is unneeded once that address is denied. The architectural fix: move the key into a cookie flagged SameSite=Strict, with cookie values omitted from proxy logs by default in nginx, with a fresh key issued after each login from the identity provider
• C.Immediately add the key to the API deny list; it was written to the access log alone, and no other system stores a URL (CDNs drop query strings). The architectural fix: hash the key client-side with MD5 before sending, with the URL carrying a digest of the secret, the gateway comparing digests rather than the raw key on each call, and the raw key staying in browser storage