Authentication is enforced server-side (PHP session). The Anthropic key lives in /secure, blocked from the web by .htaccess — it never reaches this page.