Correct. If you intend to use secure API keys to restrict search, you will do this instead of using the default Search API key.

All searches should be using secure keys, with the "default" key being a generated secure API key scoped to only access public content -- or always generate a user-specific secure key if the content is only searchable if the user is logged in.

You should never expose the default Search-only key in the front end for this use case.