Its never a good idea to have sensitive data like API keys in plain site.
Firebase cloud functions provide a way to set and access env variables.

Set env variable

firebase functions:config:set my.secret='giraffes are cool'

Note that each config value must have a 2-part key (e.g. foo.bar) otherwise it will fail.

Deploy your functions for the change to take effect

firebase deploy --only functions

Access env variable

const secret = firebase.config().my.secret

Now you know 😁