I have read on several methods to securing an API key like gitignore or placing in another file if using an application, but at some point if taken the time, anyone can get the key, even when apikey is in use or called, right? Other methods explain using a proxy which is well beyond my league. I am only aware of understanding the foundation of C# and JavaScript, and the thought of securing an apikey is mind boggling, as I think what is the most secure method. Recently, I wanted to start working on a portfolio for a better occupation, so I had thought of doing something with the Steam API, but couldn't find a concrete method to store this elsewhere and call it without anyone taking the idea of stealing or digging up this info. Even if I used it within JavaScript, how would I call this during unattended events, if I were to make a public website that was accessed by thousands of people.
Edit 1: Honestly, I have though about storing the key encrypted elsewhere, but then I would need a decryption method, as well as a key, which could still be a vulnerable method.
Edit 2: I understand that the key should be in clear text, as it is a cryptographic key itself. If stored on the server, is the api key stored in a path on the server, where only the web application is directed?