Found this: "Security recommendations emphasize that full protection requires sending scores from a game server rather than directly from the client, as this prevents users from accessing the API key."
Well, it works well enough for a game jam at least, as long as there's no Nexitron's around . 😛