API will now provide both short and long URLs. The short URL acts as a proxy; when a user opens it in their browser, the original URL will appear in the address bar. 
Discussion
I love it. If possible, as an optional flag, can the real URL never be exposed and password protected? Sharing the real URL could be an issue.
Don't worry, the data is public by design. The real secret is away in the serverless functions environment. Custom encryption keys option in api is on the horizon!