FWIW, even though this key is public I would generally pull this key from the env also rather than hardcoding it in the repo. This allows for e.g. a staging or local-dev deployment to use a different sandbox key, or whatever.