I’m about to deploy my personal blog, which is built in VueJS and will be hosted and delivered by a web-server written in Go. The posts of the blog are stored and managed by a CMS (ButterCMS) and I retrieve the content I need via fetch API.

While testing and building, I always run it locally so I could keep the CMS secret key hard-coded, but of course I can’t deploy it like this. I need to store the secret key somewhere and I saw some articles suggesting to store it in a .env file in the root directory of the project and then reading them via process.env.<key>.
While this approach is is wildly explained online, I also found a lot of sources where this method is not recommended at all (also on Vue docs)

So how am I going to do this? Where or how should I store private keys?

Thank you very much!