API keys are never stored in the browser. Add them as secrets in Cloudflare Pages (see README). This panel only chooses which provider and model to use.