The replies suggest storing the API key on a backend which you control.