API keys saved in a single-file web app are stored in this browser and can be visible to someone who can inspect the page. Restrict browser keys to your deployed domain whenever the provider supports it; for sensitive paid-provider credentials, use a Cloudflare Worker or server proxy.