Yes base64 decode the scoped api key and you can see the contents. NOTE: this is fine because the key also contains a digest that's generated from the params & server side API key. This digest is regenerated and checked again in the backend to ensure that the key contents have not been tampered.