Our IndexNow key is committed to the repository, and the auth gate was the only thing that nearly broke it

The key that proves we own the host is published at a URL on it, so it is not a secret. The interesting parts are where the file has to live, why the submitter fetches it with redirects unfollowed, and what a bare 403 from the API actually means.