Ask HN: How to securely load API key in JavaScript?

I'm trying to implement Place Autocomplete in my project. Google provides the following snippet to load the library

<script async src="https://maps.googleapis.com/maps/api/js?key=YOUR_API_KEY&libraries=places&callback=initMap"> </script>

I know that I can .gitignore .env files and pass the API KEY as an env variable. I can also restrict the API KEY to accept requests from my referrer domain. I think even if I place my API KEY in .env files users can inspect element and see the key. I was wondering if it is possible to spoof a referrer and use my API KEY. I am currently making an api call to my backend server which relays the result to the front end but that adds unnecessary latency. Hence, if possible I would like to use the Google snippet. What are industry standard practices of loading the API KEY securely in Javascript?