[thisgoodlife]

If the link contains the keys, does that mean the server can also see these keys?

[jeltz]

Nope, the secret is in the url fragment. Of course this means you need to trust that they do not change the JS code so that it steaks your keys.