The admin key is the API's only gate. Keep it secret. Both deployed consoles sit behind Cloudflare Access for a second factor, and each environment has its own key: the production key never works against staging, or the other way round.