Keep your API key on the server

Node.js — environment variable

# .env file (never commit this)
DZ_KEY=dz_live_your_key_here

// server.js
const apiKey = process.env.DZ_KEY; // correct
// const apiKey = "dz_live_..."; // wrong — do not hardcode

PHP — environment variable

# in your server or .env
DZ_KEY=dz_live_your_key_here

// PHP
$apiKey = getenv('DZ_KEY'); // correct
// $apiKey = "dz_live_..."; // wrong — do not hardcode

.NET — environment variable or appsettings

// appsettings.json (add DZ_KEY to user secrets or env vars in production)
"DeliveryZone": { "ApiKey": "dz_live_..." }

// C#
var key = _config["DeliveryZone:ApiKey"];