The key is verified server-side and never exposed to the browser. A stopgap gate — the API enforces every action.