Should backend API clients accept NEXT_PUBLIC keys as fallbacks?