Scoped API keys

A key can be scoped to the search operation only, to a specific list of collections, to a field allowlist that hides internal columns from the response, and to the browser origins allowed to use it. A leaked search-scoped key can search within those limits and nothing more — it cannot write documents, read configuration, or reach another collection.

This is what makes it safe to put a key directly in client-side JavaScript: the restriction is enforced on the server for every request, not just hidden by obscurity, so scoping a key correctly is the actual security boundary, not a convenience setting.