otherwise if they use their private api key someone can steal it and use their account to do whatever they want up to whatever dollar limit they've set on their account