How do I properly hide API keys in a MEAN stack app?

I think that the 'healthy' way of including API keys (and/or any other variables that should not be displayed to the user) is to put them in a .env (environment) file.

This is part of the node-env-file module which you can get by running the following line in Node.js:

npm install node-env-file

For example, you may have a file called 'keys.env' which contains the following lines:

KEY1 = ABC123123 KEY2 = QWE987

and your JS app can then read those variables by using process.env.x where x is the name of the key, for example your JS may contain something like this:

if ( APIkey === process.env.KEY1 ) { dosomething }

Lastly, you will want to exclude the env file from source control so that your API keys don't get into the wrong hands, so you should add a .gitignore file into the home directory, and add a line containing the name of the env file.