I use this trick for datasette-enrichments-gpt and I like it - it means I can share public demos of the plugin without needing to bake a paid API key into the demo.
I'll switch the configuration around to use the {"$env": "..."} plugin configuration mechanism. Then I'll have the query page know that if it hasn't been configured it should provide a password field for the user to enter an API key instead.
I'll persist that key in localStorage for them, like I do on https://tools.simonwillison.net/haiku