We do 2 things: 1- the API keys are only used on our servers and not the device, so no new worries about the key getting out and abused 2- we cache the result

We do 2 things: 1- the API keys are only used on our servers and not the device, so no new worries about the key getting out and abused 2- we cache the results of the API calls for 5-10 minutes with Redis. So there's no worries about the quota or rate limits. We've been doing this for about a year with 15,000 daily active users. When we publish a new release note roughly half read it within the first 24 hours. No issues to report.