The front end talks to an API and authenticates itself. Anything the browser needs to make that call, you can read too.
Hint (nudge only): Open the served bundle and scan the config object. A value that looks like a key (prefix + high entropy) has no business being in client code.