OpenAI documentation says "Do not share your API key with others, or expose it in the browser or other client-side code." This means that if you are building a web app, you should not leak the service's API key to your users.