Which answer is correct?

Put them in a `.env` file and access via `process.env.REACT_APP_API_KEY`. The bundler replaces them at build time.

— env_file

NEVER put secret API keys in frontend code — they'll be visible in the browser bundle regardless of how you load them. Use a backend proxy: ``` // Server route that holds the key app.get("/api/data", (req, res) => { fetch(apiUrl, { headers: { Authorization: SECRET_KEY } }); }); ```

— security_first

Use `window.__ENV__` injected by the server at runtime.

— runtime_env

Hardcode them and add the file to `.gitignore`.

— naive_dev