How to handle API keys for map tiles?

[eyeseast]

If I want to use Mapbox tiles (and probably others) I need to pass an API key with each request. Is there a way to keep this out of version control with metadata? Or pass it as an environment variable?

It's worth noting that Mapbox is pretty explicit that access tokens aren't secret. The best case might be to use a deployment-specific token that only allows requests from a specific set of domains.