Identity Platform reset password without making api key public

[StephenT]

I have set up my application so that users can request to reset their password.  I do this by calling https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode and it has convenient out-of-the-box functionality to email the user with a link to reset their password. 

This link is in the format https://<my-project-id>.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=<my-oob-code>apiKey=<my-api-key>&lang=en which means that the user who gets the link can see the API key. Even if I restrict this API key to access only Identity Platform, this is still not an ideal situation because a malicious user could still use that API key to try to exploit API calls to Identity Platform in my GCP project.

I would rather host a page myself, which takes only the oobCode as a parameter and then makes a server-side call to the Google API with the oobCode and the API key so that the user does not see the API key.  I see in this thread that it's possible to change the email link URL, but the generated email still adds the same parameters to whatever URL you provide there, including the API key.

Has anyone found a way around this please?

Thanks
Stephen