diff --git a/admin/api_keys.php b/admin/api_keys.php
index 009f8cce..1530a41a 100644
--- a/admin/api_keys.php
+++ b/admin/api_keys.php
@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
 $sql = mysqli_query(
     $mysqli,
     "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
-    LEFT JOIN users on api_keys.api_key_user_id = users.user_id
+    LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/modals/api/api_key_add.php b/admin/modals/api/api_key_add.php
index 0cb64a76..6c7f938f 100644
--- a/admin/modals/api/api_key_add.php
+++ b/admin/modals/api/api_key_add.php
@@ -6,6 +6,7 @@ $key = randomString(32);
 $decryptPW = randomString(32);
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index d6bd98c0..584f6d8e 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -8,8 +8,10 @@ require_once '../require_get_method.php';
 $sql = false;
 
 $api_key_decrypt_password = '';
-if (isset($_GET['api_key_decrypt_password'])) {
-    $api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
+if (isset($_POST['api_key_decrypt_password'])) {
+    // Read from the request body (parsed by validate_api_key.php), NOT the query string,
+    // so this decryption secret never lands in web-server access logs or browser history.
+    $api_key_decrypt_password = $_POST['api_key_decrypt_password'];
 }
 
 // Specific credential/login via ID (single)