Comment by sodality2

So they don't have to send the API keys to the client, where they can be abused