All of development is a pain, no way around it. Just be aware it’s a risk, you can see other threads on this forum like this one, API key theft is a real thing. All of the things you mentioned are true, but are not exceedingly complicated. Entirely possible that OpenAI invalidates keys they find in apps or with traffic on a wide variety of IP addresses. Unfortunate that there’s no communication from them on why this happened, but that’s the current state of their service.