well it is literally impossible if you're calling it from the client, which is why there is a public api key as well as a private api key