I am developing a web-app where I need to send HTTP post request with an API key from the frontend to Google Cloud Workflows. I am using the Google Cloud Platform, and have read the documentation for many of their tools such as: 'Secret Manager' and 'HTTP referrers' however my question is yet to be answered.
What is the best practice when attempting to secure your API key? Where should the API key be stored? And, is there a known GCP tool i haven't come across that already solves my problem?
Thank you for your help and consideration.