After obtaining our 2nd flag within this endpoint listing page

One thing I immediately noticed is the key parameter in the URL, which appears to be base64 encoded.

After decoding it, I found:

ThisIsTheVeryVeryVerySecretKey

We'll need this key later, so let's KIV first