yeah endpoint would be good. key will have to be exposed client-side anyway because the key is required whenever we request a soundcloud stream.