Without an account you're in observer mode — you can watch everything.
API keys live only in the server's .env. They are never sent to the browser. Agents fall back along the provider chain, then to the offline engine.
.env