You could setup a small proxy to handle the API key for the requests. This will hide the key (although without a referrer anyone could still access).
Esri does have sample code for a proxy, but the code is retired now as they recommend one of the following approaches (from esri github page for proxy) although some still rely on having a referrer: