As per enviornement variables you can utilize https://pub.dev/packages/flutter_dotenv the package and set your env. there and load them as per your app hiting prod or stage etc.

Or you may go through another solution in the image attached.

If your system as AWS Amplify as your cloud you may use the package to fetch the variables as well: https://pub.dev/packages/amplify_secure_storage

I hope one of the solution helps you.

EDITED: But all in all, the keys are never 100% protected on client side. There's always a missing point.