How secure is to append a secret token as query string in a htaccess rewrite rule?

I was doing some tests while trying to provide an answer to mod-rewrite redirect but prevent direct access.

Original question goal is basically mask example.com/public/foo as example.com/foo while forbidding access to the real URL example.com/public/foo.

Once I found a possible solution appending a token to the rewritten URL's Query String,

RewriteCond %{REQUEST_URI} !/public/
RewriteRule ^(.*)$ /public/$1?token=SECRET_TOKEN [L]

RewriteCond %{REQUEST_URI} /public/
RewriteCond %{QUERY_STRING} !token=SECRET_TOKEN
RewriteRule ^(.*)$ / [R=403,L]

I realized (with Chrome's DevTools) that I really can't see this token in the Request Headers.

I understand that's because the first RewriteRule doesn't trigger a redirect on the client and all this rewrite process takes place in the server.

If I am right, this SECRET_TOKEN is secure, isn't it? (By secure, I mean it can't be known by the client in any way)