API access is available from the Starter plan, with a request limit tied to the plan.
Create a key
From workspace settings, create a key with only the permissions it needs. Copy it immediately and keep it in your secret manager.
Protect the key
Never embed the key in a web page or distributed application. Send requests from your server and replace any exposed key.