Keep your API keys safe

• API keys belong on servers, never in browser JavaScript or mobile apps.
• Create a separate key for each app or agent so you can revoke one without breaking the others.
• Give agents a daily cap, or a read-only key when they don't need contact details.
• If a key leaks, open API keys and revoke it. It stops working immediately. Then create a new one.

The site key in your tag (site_...) is different: it's meant to be public, and live sites only accept visits from your own domain.