Its never a good idea to have sensitive data like API keys in plain site.
firebase functions:config:set my.secret='giraffes are cool'
Note that each config value must have a 2-part key (e.g. foo.bar) otherwise it will fail.
firebase deploy --only functions