The CRM API key stays server-side and is never exposed to the visitor.
After successful testing: delete setup.php.
setup.php