The copilot calls the model API directly from your browser. Your key is stored only in this browser's localStorage and sent only to the provider's API host.
localStorage