On properly designed privacy respecting systems, the client sends the request to the trusted server with whatever API keys are needed to make it work.

But that would break the server lock-in subscript model, so only downloadable software would work.