Key used should not be public! It should be private to the server. This is why we are not putting it into the code and are using settings in the first place.