No. Don’t call the Protoface API directly from the browser.
Keep your PROTOFACE_API_KEY, LiveKit API secrets, and worker-token minting on a trusted backend, never in browser or mobile client code. The browser should only receive short-lived credentials generated by your backend for that user or session.