How can we be certain that our api key is not sent to your server?