OneSignal: Send push-notifications from app code

I'm wondering if sending notification directly from the client app is secure, because I need to include the REST API key in the header, as follow:

Future<Response> sendNotification(List<String> tokenIdList) async{

  return await post(
    Uri.parse('https://onesignal.com/api/v1/notifications'),
    headers: <String, String>{
      'Content-Type': 'application/json; charset=UTF-8',
      'Authorization' : 'Basic \u003cMY_REST_API\u003e',
    },
    body: jsonEncode(<String, dynamic>
    {
      "app_id": "MY_APP_ID",

      "include_external_user_ids": tokenIdList,//tokenIdList Is the List of All the Token Id to to Whom notification must be sent.

      // android_accent_color reprsent the color of the heading text in the notifiction
      "android_accent_color":"F44336",

      "small_icon":"ic_stat_onesignal_default",


      

      "headings": {"en" : "test"},

      "contents": {"en" :"test"},


    }),
  );
  
}

I followed the instructions in the official documentations (https://documentation.onesignal.com/reference/create-notification#send-to-specific-devices) and I must add the Rest API key in my app code, even if in this page they reccomend not to add it to the app code.