Security of REST API keys
To clarify, they are two ways of accessing the api over the net, the REST interface (that uses the keys) and the ajax one (that is used for the front end js, and doesn't need the keys)

So if it's client js, the authentication is done through the CMS, so via the cookie session. You shouldn't use the keys.

What we recommend is to always use POST when we use the REST, not matter the action, precisely to avoid having the keys in the GET params, so it's not left in the logs and a bit more protected in general

X+