they need to make a public api key for that snippet, and restrict the assistant ids and domains with access to it