A server API key belongs on the server that calls the podcast service. A browser bundle or mobile app is a public copy of your program. A key inside that copy can be read, even when the code is small or difficult to understand.
Draw the request path
For catalog search, a simple path is browser → your application server → podcast API. Your server adds the secret header. It returns only the fields the screen needs. The browser never receives the server key.
For listener state, Podnivo documents short-lived listener tokens. Your authenticated backend can mint a token for the correct listener. That token has a different purpose from the long-lived workspace key. Read the current contract before choosing which endpoints the client may call.
Do not create an open forwarding route that accepts any upstream path. A route named /search should perform search, validate a query, and set a limit. It should not let a visitor ask your server to call an account or administration endpoint.
Check the places secrets often escape
Search generated JavaScript, mobile build resources, error reports, request logs, and copied curl examples. Keep authorization headers out of analytics events. A helpful debugging message can say which environment failed without printing its credentials.
Use separate configuration for development and production. A local environment file should stay outside Git. A deployment secret belongs in your hosting system's secret storage.
During review, ask another developer to open the browser's network panel. They should see the public request and its result, but no workspace key. That small check tests the real boundary better than a comment saying “keep secret.”