removed reading x api key from query object for better security that is not allowed

Author: yash-pouranik

apps/public-api/src/middlewares/verifyApiKey.js

@@ -8,13 +8,9 @@ const {
 module.exports = async (req, res, next) => {
     try {
         // x-api-key header is preferred. For browser-navigation endpoints (e.g. social OAuth start),
-        // fall back to ?key= query param but only allow publishable keys via query to avoid
-        // secret key exposure in server access logs.
         const headerKey = req.header('x-api-key');
-        const queryKey = req.query.key && !String(req.query.key).startsWith('sk_')
-            ? req.query.key
-            : undefined;
-        const apiKey = headerKey || queryKey;
+
+        const apiKey = headerKey;
         if (!apiKey) {
             return res.status(401).json({ error: 'API key not found' });
         }