The API key is just a public key that gives read-only access to the Google Maps JavaScript API. It gets printed in the `<script>` on the page any way, and as I say it’s read-only access, so it’s not a security issue having it in a configuration file.