Use the configured owner token. It is exchanged for a secure browser session and is not kept in the URL.