A shared contract, a deterministic engine that stays the source of truth, and an API key that never reaches the browser.