Security note: All API keys are stored as server-side environment variables and proxied through the backend. The header x-apisports-key is set server-side only — never in client requests.