As far as I know there isn't a way to do it just from client-side. As
you point out, there is no way to hide you API key and it isn't locked
to a domain.
The simplest solution would be to use the lookup API in a simple
script and then have the client call that.
--Sam