hmm ok I found it in the request headers in browser tools... it's using one of my random restricted production API keys...