The secret key stays on the server
Listing your events needs a key that can also create and modify them. The plugin makes that call from WordPress itself, through an admin-only route, so the key is never written into a page a visitor can read.
server-side · never in the browser