Is it secure enough to run from my own server?

Yes. The API key is shown once and stored only as a SHA-256 hash, every request is authenticated, rate-limited and scoped to your shop alone, and you can rotate the key in one click — the old key stops working instantly.