Environment variables (.env) are THE way to keep your sensitive data like API keys secure and away from users. You define them in special .env.local files on your local machine and then define them wherever you deploy your React / NextJS project.
While you can use secure .env variables in NextJS, due to the nature of React (being client-side rendered), you can only use public environment variables in React. To interact with APIs in React, you'd make a request to a NodeJS server that contains the server-side env variables.
Hope you found this video helpful, and have fun coding your following projects!
Josh