I know that I am not supposed to place keys in my client sided application, such as a web application. But, there are more and more service providers (e.g. Google, Amplitude, etc) these days that are instructing us to place keys in our web application’s JavaScript code.

How exactly do these providers ensure that no other developer is stealing my app key to be used in some other application while making me liable for their usage? I have seen some providers ask me to whitelist the site in which I plan to place my key. But how exactly do they guarantee that developers don’t spoof this information in the request headers? Isn’t that super easy? What other mitigation tactics do they use? I’m just confused how this has become a standard with some service providers. Seems like there should be an obvious answer here that I am unaware of