[z991]

The entire thing is frontend only (except for the share feature) so the server never sees your key. You can validate that by watching the network tab in developer console. You can also make a new / revoke an API key to be extra sure.

[jquery]

Please make a new API key folks. There's a lot of tricks to scrape a text box and watching the network tab isn't enough for safety.

[gardenhedge]

Who could scrape the text box in this scenario?