Public keys now only accept requests from websites you list. Add them under Settings, Public keys, in the new Allowed domains card. Enter a hostname such as app.example.com, or *.example.com to cover every subdomain. localhost is accepted for development. Internationalised domain names are stored in their ASCII form. If the list is empty, public keys refuse every request, so add your sites before you go live.
See the REST API guide.