The active key is needed to grant posting authority. The best way to do this is by signing a transaction locally on your browser so that your keys never leave your device.

The best way to do this is by using Hivesigner or Hive keychain. It is not a best practice to input the active key directly on the website. If 3speak is doing this it doesn't mean that they keep the active key (if the operation is done locally on your browser) but it is a security risk if the website is compromised.

Once the posting authority is granted by signing the operation with the active key it is no longer needed to interact with the app or website.

Does 3Speak use Hivesigner or Keychain?