Search engines need a search-only key in the browser

Meilisearch and Typesense both expect to be queried directly from the browser, which is why they issue more than one kind of key.

The master or admin key can read everything, change settings and delete indexes. A search-only key can run queries and nothing else. Only the second belongs in a bundle.

Generate a search-only key — for Meilisearch use the /keys endpoint with the "search" action; for Typesense create a search-only API key, optionally scoped to specific collections.

Put that key in your front end, keep the master key in server environment variables, and rotate the master key since it has been public.

Try a write with the browser key — for example a settings update or a document delete. It must be rejected. If it succeeds, the key is still too powerful.

Assuming a self-hosted instance is safe because the URL is obscure. If the browser can reach it, so can anyone who reads the bundle; there is no such thing as a private URL in client code.