Yes, you are. It would be the same in any other frontend tool.
It is not a problem if:
- the key is meant to be public,
- you have taken steps to ensure unauthorized users can’t get data from the backend.
See this thread for more guidance on the topic.