API Key Exposure in node.js sample app

HI, quick quesiton,

just looking through your sample streaming repo

https://github.com/de-id/live-streaming-demo/blob/main/streaming-client-api.js

all of the code in the sample runs client side, so api keys are exposed to the user and someone could grap the key and run the credits of the api keys account into the ground.

If I understand correctly only the webrtc conection needs to be established on the client. The fetch request could run server side as well as they only do signaling and data parsing, Is that correct?