github sample code for stream endpoint and question about apikey

https://github.com/de-id/live-streaming-demo

I'm trying to create an application by referring to the streams endpoint sample, but in this sample code, the part that calls DID_API.key in streaming-client-api.js is included in client javascript. Isn't it dangerous?

If it is dangerous to use the sample logic on the client side, could you give me some hints on how to change the source or how to handle the key in the backend's own API server?