Putting your API on the same hostname and presumably the same codebase as your website is not a great long-term strategy. And mentioned before, consider HTTPS to protect the API key.