These catalog endpoints are publicly accessible and designed for use in your frontend code. As such, there are no secrets involved.However, you must include your clientId in the header of all requests.
Header
Value
clientId
your-unique-client-id
CAUTION
Do not pass your api key (secret). Only use your public clientId.