API keys should be used server-side only. Sub part of #20
API keys should be used server-side only.
Sub part of #20