Your key is sent over HTTPS in the request body and used only for this check, then discarded: it is never stored, logged or shown again, and this page clears the field as soon as you run. It makes about 21 small requests with the provider's low-cost model, billed to your account. Use a key you can revoke, and avoid shared or production keys.