Settings.

API keys are validated against the provider, stored in the private database bucket, and used by every environment that shares this database (local and production). They are never sent back to the browser.