Requests run straight from your browser — keys are never sent through third-party proxies. Experiment with a sk_test_…sandbox key: the API refuses live sk_prod_ keys from this page (403 LIVE_KEY_FROM_PLAYGROUND).
sk_test_…
sk_prod_
403 LIVE_KEY_FROM_PLAYGROUND