Is this allowed? (This bring your own key usage)

This doesn’t make sense. When I first started with OpenAI, I did not have my own server. I connected with someone who did have a working chat completion system, and used my key there. You’re telling me that this violates the OpenAI terms of service? So, everyone who wants to obtain an OpenAI API key has to have their own API infrastructure in place, or else they can’t use the key? What about renting/leasing the infrastructure?

And how, exactly, is placing the key in a cookie or otherwise embedding in browser safer than being stored in a secured server?