We use Algolia and use the public API keys with search filters encoded so they can only search their data (I.e. account_id:123)
Is there anything similar here? Otherwise all the queries need to go through our servers first to ensure the filter is present.