Every API request needs to be authenticated with an API key passed via an HTTP header.

Never expose API keys in client-side code. Keep them in environment variables and call the API from your backend.