Doesn't seem to be considered secret. Presumably the api key is tied to the registered domain and the license for self-hosted is just to ensure GPL compliance.

https://www.tiny.cloud/tinymce/security/

Note: Tiny does not consider an API Key to be private or sensitive data.

https://www.tiny.cloud/docs/tinymce/latest/license-key/

What is the difference between a license key and the API key?

The API key is used when loading TinyMCE from the Tiny Cloud. The license key is used to declare the license terms when self-hosting TinyMCE.

Should I be using both an API key and a license key?

No, an API key and a license key should not be used simultaneously. The API key should only be used if TinyMCE is loaded from the Tiny Cloud. If TinyMCE is being self-hosted, the license key option should be used instead.

Will TinyMCE “phone home” to check the license key?

No. TinyMCE does not contact any server to validate the license key.

What happens if I don’t provide a valid license key?

The console log message or notification will persist until a valid license key or 'gpl' is provided.

Why is a license key required?

The license key ensures compliance with TinyMCE licensing terms. It’s part of our efforts to refine the license key system and may have additional functionalities in the future.