I think the best way to do this is to setup a simple backend proxy, so that user prompts are sent to proxy which then uses the API key to actually call the API and receive its output.
The backend proxy would need some protections too as it will be exposed to the public internet