title: Filepicker API key
body: <p>I like to ask a newbie question. By setting API key in JavaScript, wouldn't anyone can read the source and use the key freely?</p>
  
  <p>Edited >></p>
  
  <p>Extracted the jsFiddle codes,</p>
  
  <pre><code>filepicker.setKey('8PbzrhP9Tr2r6wPlSqzS');
  
  /* Unsecured */
  
  
  /*
  filepicker.pick(function(fpfile){
     console.log(fpfile);
  });
  
  filepicker.read(fpfile, function(contents){
      console.log(contents);  
  })
  */
  
  
  var fpfile = {'url': 'https://www.filepicker.io/api/file/KW9EJhYtS6y48Whm2S6D'};
  var policy = 'eyJoYW5kbGUiOiJLVzlFSmhZdFM2eTQ4V2htMlM2RCIsImV4cGlyeSI6MTUwODE0MTUwNH0=';
  var signature = '4098f262b9dba23e4766ce127353aaf4f37fde0fd726d164d944e031fd862c18';
  
  
  filepicker.read(fpfile, {policy: policy, signature:signature}, function(contents){
      console.log(contents);  
  })
  
  filepicker.pick({policy: policy, signature:signature}, function(fpfile){
     console.log(fpfile);
  });
  </code></pre>
  
  <p>How does it prevents anyone from using the key ONLY, to upload or read/download files from my account?</p>