you don't, you provide a public api key which you should create specifically for your widget and restrict the assistant ids and origin domains that can call it