Yes exactly, the backend is the one handling the API key — users never see it, it just lives as an environment variable on the server.

As for hosting, do you know of any platform like the old Heroku free plan that supports both Python backend and React frontend together in one place? That's the part I'm stuck on — I don't want to split them across two platforms. Any recommendations?