Brightcove's Playback API and policy-key guidance describe a client-facing read model distinct from server-side CMS management. A Brightcove integration should use credentials appropriate to the task.
Do not put management credentials into a player merely to make a catalog request work.
Akousa