From your backend, send the full key string on every request as the api-key HTTP header:
api-key: secret_live_xxx
Never expose API keys in browsers, client-side JavaScript, or mobile app bundles. InkLink requests must run only on your backend–route end-user traffic through your server so the key never ships to clients.
