The API key stays in your browser's localStorage only — it is never sent anywhere except api.tokenfactory.nebius.com. Without a key the demo runs fully offline on the rule engine (badge turns grey).