My answer is yes, it's insanely easy. Don't try to secure your API keys instead try to secure your API.