If it's called from Javascript in the browser, it's not a secret API key....

Which is why Google calls it a public API key...

there are plenty of API keys distributed like this by design. For example, google maps requires this, else your (anonymous) users can't use an embedded google map on your website. And a public firebase app needs some kind of API key, too.