A Super Search for "hide password" shows various results, e.g. Hide DBI password in scripts or Password encryption. In the latter thread, someone mentions a service account (that runs the script). What about a service account on the web server? (By this I mean a special username and password just for this special GET request)

Edit 2020-01-15 corrected link