Will you be flooded with spam messages now that you have published the magic URL?

Some twisted soul could even put sending a message to you via cronrab every minute, and you don't seem to have any way to block it, or filter it from the rest.

I'd say that it's infinitely better to have an opaque an otherwise useless API token in your bash history than to have a URL of a bare and uncontrolled web service in the same bash history, and now on the open internet.

If I were to design a service like that, I'd have an URL like domain.api/username/${token}, where the token can be changed and / or retited, should it become a target of a spam attack. Exporting this token once in the beginning of a shell session should not be hard; SSH even allows you do it with SendEnv.