diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c55982..35d0863 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-- update "text" key to "body".
+- allow "key" to be passed as a parameter
+- rename "text" to "body".
 
 ## [3.1.0] - 2021-07-18
 
diff --git a/matrix_webhook/__main__.py b/matrix_webhook/__main__.py
index 2977f72..17305cc 100644
--- a/matrix_webhook/__main__.py
+++ b/matrix_webhook/__main__.py
@@ -38,10 +38,14 @@ async def handler(request):
     except json.decoder.JSONDecodeError:
         return create_json_response(HTTPStatus.BAD_REQUEST, "Invalid JSON")
 
-    # legacy naming:
+    # legacy naming
     if "text" in data and "body" not in data:
         data["body"] = data["text"]
 
+    # allow key to be passed as a parameter
+    if "key" in request.rel_url.query and "key" not in data:
+        data["key"] = request.rel_url.query["key"]
+
     if not all(key in data for key in ["body", "key"]):
         return create_json_response(
             HTTPStatus.BAD_REQUEST, "Missing body and/or API key property"
diff --git a/tests/start.py b/tests/start.py
index 3acb3b5..f235edd 100755
--- a/tests/start.py
+++ b/tests/start.py
@@ -25,12 +25,17 @@ parser.add_argument(
 )
 
 
-def bot_req(req=None, key=None, room_id=None):
+def bot_req(req=None, key=None, room_id=None, key_as_param=False):
     """Bot requests boilerplate."""
+    params = {}
+
     if key is not None:
-        req["key"] = key
+        if key_as_param:
+            params["key"] = key
+        else:
+            req["key"] = key
     url = BOT_URL if room_id is None else f"{BOT_URL}/{room_id}"
-    return httpx.post(url, json=req).json()
+    return httpx.post(url, params=params, json=req).json()
 
 
 def wait_available(url: str, key: str, timeout: int = 10) -> bool:
diff --git a/tests/tests.py b/tests/tests.py
index 096dace..2bc97e3 100644
--- a/tests/tests.py
+++ b/tests/tests.py
@@ -18,13 +18,21 @@ class BotTest(unittest.IsolatedAsyncioTestCase):
             {"status": 400, "ret": "Missing body and/or API key property"},
         )
         self.assertEqual(
-            bot_req({"body": 3, "key": None}), {"status": 401, "ret": "Invalid API key"}
+            bot_req({"body": 3}, "wrong_key"), {"status": 401, "ret": "Invalid API key"}
+        )
+        self.assertEqual(
+            bot_req({"body": 3}, "wrong_key", key_as_param=True),
+            {"status": 401, "ret": "Invalid API key"},
         )
         # TODO: if the client from matrix_webhook has olm support, this won't be a 403 from synapse,
         # but a LocalProtocolError from matrix_webhook
         self.assertEqual(
             bot_req({"body": 3}, KEY), {"status": 403, "ret": "Unknown room"}
         )
+        self.assertEqual(
+            bot_req({"body": 3}, KEY, key_as_param=True),
+            {"status": 403, "ret": "Unknown room"},
+        )
 
     async def test_message(self):
         """Send a markdown message with the old format, and check the result."""