Those are "Public Keys", self-explanatory from the name, it is publically accessible.
That's how it is supposed to work.
Private keys are always hidden and used only on the backend.
===
Google IP and HTTP restricted keys can also be found to be stored in the LocalStorage. But since it is already IP and HTTP restricted, it cannot be used on other domains.