It depends. If it's client-side JS (namely, it's run on a script on a webpage) then you should absolutely not call the LimeLM web API from this.
If you're talking about server-side JS (like NodeJS stuff) then, sure, you can call the web API from that.
Keep in mind the API key is like a password. Don't ever put it in a place where it can be accessed from an end-user (malicious or not).
Does that make sense?