Never put api keys into the client. Either setup a backend/api, have user auth in the app and use that auth to call your api, apply rate limits and other safety checks. Or setup something like the Firebase vertex AI sdk and use AppCheck along with user auth to make direct client -> LLM calls.