Currently the project does not 'just work' when cloning and following the README steps.

It appears that there are some steps needed to configure the server via /server/config/local.env.js where it needs a SESSION_SECRET to be defined.

What about on the client side? Is there somewhere that I need to put the API key as well?

Looks like the key is hardcoded into each client request, doh! That needs to be pulled out into a service.