What Is a Form Endpoint?
A form endpoint is the URL you put in a form's action attribute. Each endpoint belongs to one form, and the key inside it identifies that form so submissions land in the right place.
An endpoint key looks like a secret and people treat it like one, but it is not. It sits in the HTML of a public page, which means anyone who views source can read it. That is fine as long as the key can only do one thing.
A well designed endpoint key is write-only. It accepts a submission and nothing else. It cannot read the submissions already stored, cannot change the form's settings, and cannot be traded for an account token. If a key can do more than accept a POST, publishing it in your HTML is a real problem rather than a theoretical one.
This is also why leaked endpoint keys are an annoyance rather than an incident. The worst case is someone posting junk at your form, which is a spam filtering and rate limiting problem, not a data breach. Rotating the key changes the URL and the junk stops.
In WebForms
WebForms endpoint keys start with wft_ and are write-only. Reading submissions requires a separate API key with its own scopes, which never appears in a page.