For every subscription request coming from client, I need to authenticate the client. Is there a way we can avoid sending to auth token in URL params?

What is the proper way to send auth token?