Bubble exposes my api although Authorization key is set?!

Hello,
can you look at my new topic which explains better?
http://forum.bubble.io/t/how-to-prevent-users-make-api-calls-outside-of-website/243423