What’s the correct way to handle environment variables and private keys in Expo apps?

I want to use Expo to publish an app to the App Store and Google Play, but I’m a bit confused about how to properly handle environment variables and private keys.

For example, Expo lets you store environment variables in the dashboard as plain text, sensitive, or secret. Is this the correct/recommended way to handle things like API keys and private keys? And how secure is it in practice?

I understand that anything bundled into the client app can potentially be exposed, so I’m mainly wondering what should and should not be stored in Expo environment variables.

How are you guys handling this in production apps?

Thanks in advance!