Your key is used directly from the browser and never stored or sent anywhere except Anthropic's API. For production use, proxy calls through your own backend.