But how was the API key stored? If it's stored inside the binary, without an intermediate server managed by OP, someone could've disassembled the binary and sta

But how was the API key stored? If it's stored inside the binary, without an intermediate server managed by OP, someone could've disassembled the binary and starting using the API key independently for their own gain, triggering abnormal usage. Say, one of our Windows products uses a web API for TTS, and we've built an intermediate web server which stores the key and manages rate limits per user so that there was no abuse (the app uses our own auth).