Its never a good idea to have sensitive data like API keys in plain site.
firebase functions:config:set my.secret='giraffes are cool'
Note that each config value must have a 2-part key (e.g. foo.bar) otherwise it will fail.
firebase deploy --only functions
const secret = firebase.config().my.secret
Now you know 😁