diff --git a/apps/docs/src/content/docs/api/chat.mdx b/apps/docs/src/content/docs/api/chat.mdx
index e764794..5bb7785 100644
--- a/apps/docs/src/content/docs/api/chat.mdx
+++ b/apps/docs/src/content/docs/api/chat.mdx
@@ -14,12 +14,11 @@ The websocket server is located at `wss://hackclub.tv/api/chat/ws/:username`, wh
 You'll need to provide authentication, which can be done by providing an `auth_session` cookie, just like the REST API.
 
 <Aside type="tip">
-Bot accounts are now supported. You can choose to connect as a bot by providing a bot account's API key in one of two ways:
-- Using the `Authorization` header: `Bearer hctvb_xxxxxxx`
-- Using the `?botAuth=hctvb_xxxxxxx` query parameter
+Bot accounts are now supported. You should connect as a bot by providing a bot account's API key using the `Authorization` header:
 
-**Security Note:** When using the `?botAuth=` query parameter, be aware that query parameters may be logged in server logs, and/or proxy logs. Use the `Authorization` header method whenever possible. The query parameter method should only be used when connecting from an environment where headers cannot be set.
+- `Authorization: Bearer hctvb_xxxxxxx`
 
+**Security Note:** Do not pass bot API keys in query parameters (for example, via a `?botAuth=` query string), because URLs and their query strings are much more likely to be logged or stored in browser history. Always use the `Authorization` header for bot authentication.
 It is highly advised to use a bot account for any automated task, and to implement anything pointed out in this page.
 </Aside>