Hi, @ainneo, we don’t add the environment variables to the site code but the site build process might do this.
Regarding how to make use of API keys without including those keys in the deployed site, the usual solution is to use Functions for this. There is a support guide about this here:
If there are other questions that guide above doesn’t answer, please let us know.