The fact that it's the string "None" rather than a message telling you that no api key was provided leads me to suspect that your code is somehow providing this string as the key to use.
Is something in the backend using Python (which has a "None" type), maybe? (it's a reach)
This does not look like a browser network security issue to me, it sounds like this is the response coming back from a successfully connected attempt that has a bad API key. (But I'm 3rd party dev who defers to anyone else more confident)