I see that even on the client side in JS you need to provide your api-key. How is this secure in that someone else doesn't just use your api key? If it is exp

I see that even on the client side in JS you need to provide your api-key. How is this secure in that someone else doesn't just use your api key? If it is explained on the site forgive me for not finding it.