It is an important topic indeed.
During the creation of my DUPLICATE Quote and Line Items functionality for my CRM App, I had to investigate heavily the subject, and found a very nice and MOST Secured solution.
Take into account that my App is embedded in WordPress web site.
I just put the secret keys in my server files, that are called by a php snippet inside a code snippet plugin (WPCode) in my WordPress website. And the Knack API JS code is working with it.
A free and secure solution.
For months now it has been working perfectly and safely.
So that should give you some good ideas to make it work for you.
Enjoy!
Michael