Indeed. It’s probably why so many APIs accept the api key in the URL.