If it’s a Google Doc, does that mean the end user could read the Apps Script code?
yes...but there must be a way to prevent it. I need to explore that.
Mighty dangerous if they can get the API creds.
AFAIK you have to publish an app in order to hide the source code from the client.