diff --git a/app/services/aspace_client.rb b/app/services/aspace_client.rb
index 3fffccbe..3dc9bcf9 100644
--- a/app/services/aspace_client.rb
+++ b/app/services/aspace_client.rb
@@ -203,8 +203,8 @@ def send_request(method, path, body = nil)
   # https://archivesspace.github.io/archivesspace/api/#log-in
   def session_token
     @session_token ||= begin
-      uri = URI.parse("#{@base_url}/users/#{@user}/login?password=#{@password}")
-      res = Net::HTTP.post_form(uri, {})
+      uri = URI.parse("#{@base_url}/users/#{@user}/login")
+      res = Net::HTTP.post_form(uri, { password: @password })
       raise StandardError, "Unexpected response code #{res.code}: #{res.read_body}" unless res.is_a?(Net::HTTPOK)
 
       JSON.parse(res.body)['session']
diff --git a/spec/services/aspace_client_spec.rb b/spec/services/aspace_client_spec.rb
index d484f083..5ff12b1d 100644
--- a/spec/services/aspace_client_spec.rb
+++ b/spec/services/aspace_client_spec.rb
@@ -12,7 +12,7 @@
   before do
     # Authentication request
     stub_request(:post,
-                 "#{url}/users/#{user}/login?password=#{password}").to_return(body: { session: 'token1' }.to_json)
+                 "#{url}/users/#{user}/login").to_return(body: { session: 'token1' }.to_json)
   end
 
   describe '#initialize' do