diff --git a/src/integration/blockchain/lightning/lightning-client.ts b/src/integration/blockchain/lightning/lightning-client.ts
index 3c30d810ee..f01a8e9ef7 100644
--- a/src/integration/blockchain/lightning/lightning-client.ts
+++ b/src/integration/blockchain/lightning/lightning-client.ts
@@ -534,7 +534,7 @@ export class LightningClient {
 
   async getBoltcards(adminKey: string): Promise<BoltcardInfoDto[]> {
     return this.http.get<BoltcardInfoDto[]>(
-      `${Config.blockchain.lightning.lnbits.boltcardsApiUrl}/cards?all_wallets=false&api-key=${adminKey}`,
+      `${Config.blockchain.lightning.lnbits.boltcardsApiUrl}/cards?all_wallets=false`,
       this.httpLnBitsConfig(adminKey),
     );
   }
@@ -596,8 +596,9 @@ export class LightningClient {
       httpsAgent: new Agent({
         ca: Config.blockchain.lightning.certificate,
       }),
-      headers: this.lnBitsForwardHeaders(),
-      params: { 'api-key': adminKey, ...params },
+      // key goes in the header, not the query string, to keep it out of LNbits access logs
+      headers: { ...this.lnBitsForwardHeaders(), 'X-Api-Key': adminKey },
+      params: { ...params },
     };
   }