So, I recently developed an Outlook Add-In. The Add-In displays data from an external system, for which an API call is made. However, I was looking to host the add-in. One thing could be via a Web App. But how do I securely store the API key without compromising anything?

Since the manifest.xml takes exact urls, I am not sure if using a secured (for example) api would work.

Can anyone help me out or give me suggestions? I dont want to have my Keys out in the public.

So far I did not try to host it, since I firstly want to know what a secure option would be. I know for example that functions could theoretically work, but I am not sure of it actually will.