[necovek]

In essence, the best you can do is have an authorization dance that results in a short lived authentication token.

Or you could use some obfuscation like symmetrically encrypting the key, but clients will see the encryption key too (and in the inspector when Maps API is hit).

Or you could have a server side proxy, but that proxy will be publicly available too.

As frontend code works on the client, there is no real way to hide the API key, so I wouldn't really bother adding any complexity.