That’s correct. From Typesense’s perspective, access to records is controlled using scoped search api keys