Public search query: generated client sends the API key as a query param — the docs said header-only and the key leaked into logs