It's a good question @gggg. Here is our official documentation on the subject:
https://developers.arcgis.com/documentation/mapping-apis-and-services/security/security-best-practic...
In short, it's a good idea to limit your API key to consume only the services you require, and use the allowed referrer to limit usage to your app's URL. Also, you should monitor the API key's usage, and delete it when you're done, and/or rotate your API key as needed.
