I like this! I feel like I've written a half-version of this a dozen times, it's nice to see a version which is fully fleshed out.
One feature request: you could likely fully remove the need for an NPM package by accepting POST requests from forms, and staple the API key in with either the URL or an <input type="hidden" value="key"/>—is that in the roadmap?