It's always a good idea to externalize application keys/secrets from code.
Google Firebase Functions has a feature that allows you to specify environment variables of key/value pairs using Firebase CLI and can be accessed by your code at runtime.

Set env variable

firebase functions:config:set config.key="SECRET_KEY" config.pass="SECRET_PASS"

NOTE: You must redeploy functions to make the new configuration available.

Deploy functions

firebase deploy --only functions

Accessing env variables

const secretKey  = firebase.config().config.key;
const secretPass = firebase.config().config.pass;

Retrieve all variables

firebase functions:config:get

Output:

{
  "config": {
    "key": "SECRET_KEY",
    "pass": "SECRET_PASS"
  }
}

Unset a variable

firebase functions:config:unset config.key

Let's consider using a file where we can keep all the environment variables.

env.json, a file that will contain all our environment variables.

{
  "config": {
    "host": "domain",
    "key": "SECRET_KEY",
    "pass": "SECRET_PASS"
  }
}

How to deploy the variables with the env.json file?

firebase functions:config:set env="$(cat env.json)"

Great! Now we can make a bulk update of our variables and keep track of them.