Thanks! The key is not private, it‘s simply a ‘favor’ to the API to identify where the requests are coming from. The app gets a higher rate limit in exchange for registering.
Still, it means that someone else can copy your API key and abuse the API on your behalf.
I don't think so. Stack Exchange checks the referer header.
Which can also be spoofed.
Fwiw, the author of the API is a co-worker and I checked with him first, he says it’s all fine. Or put another way, if it’s not fine I’ll hear about it. :)
This is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.