Restrict the Key in the console to use only by a specific app (your apps packagename and hash).
Add restrictions to your API key so that only your apps are allowed to use the API key. More details on adding restrictions to API keys can be found here.
Make sure to restrict the key as DonManfred wrote and also make sure that the key is stored as a process global string value. This way it will be obfuscated.