What is in clients hand is by definition not secret anymore. Regardless what you do, if they are dedicated enough they can get the information that is located inside the client.
Instead why not let the client authenticate itself against the server and let the client just ask for the data? The server would not hand out the api key to the user but the result of the request that the client would make. This has some further benefits:
You can cache the results in case multiple clients make often the same requests
You know and can control which client is calling how often the endpoint
If data manipulation is needed (the return data from the endpoint), you can do this on the backend out of clients sight. In case of huge data this can save the client computation power. It could be a legal requirement. Or you can enrich the data. Or restructure to fit better your client.
People just can't take apart your client to recreate your app since the business logic (handling of endpoints, secrets) is not located in the client.