Keys and domain locks
There are two kinds of key and they are protected in completely different ways. Treating them alike is the mistake worth avoiding.
Bot key — bot_…
Public by necessity: it sits in your page source so the widget can identify itself. It is not a secret and rotating it is not the control. What protects it is the domain allow-list — on an origin you have not listed, it simply will not answer.
API key — mc_sk_…
A genuine secret. Server-side only — never in client JavaScript, a mobile app, or a public repository. Anyone holding it can query and ingest against your workspace. If one leaks, revoke it in the dashboard rather than trying to contain it.
Subdomains are separate origins. acme.com and www.acme.com are two allow-list entries, and forgetting the second is the most common reason a widget works locally and not in production.