This is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.

Fwiw, the author of the API is a co-worker and I checked with him first, he says it’s all fine. Or put another way, if it’s not fine I’ll hear about it. :)