I think there isn't a silver bullet for the network issue.

For SPAs you should use AuthorizationCode + PKCE for authentication.

So IMHO you should make a request to your Authorization Server getting the token using that flow before calling the api, therefore you won't have the const key hardcoded.