How can I keep API keys out of source control?

I have a similar issue however my app is a plugin for another application and now those keys need to be transferred to every systems that will use this plugin.

The host application and all plugins are written in Node so these api keys don't get compiled into the source and will be sitting clear text.

How can I secure these keys?

Follow step 3 of the 12 factor app methodology, le duh!

http://12factor.net

If you're building apps for public clouds, you really should be following most of those steps conceptually.

Read 'Better Builds with Maven'.

This problem was solved many years ago.