Keep credentials and spending controls on your server
Your frontend should authenticate to your application, which authorizes the user before calling OmnAPI. Never put a real account key in browser code, a public repository, or an analytics event. Apply per-user limits and validate all input fields on the server. Review the current operation price before creating paid work.