I’ve set up an API (using HTTP protocol)

Within this API there’s a route with integrations set up that has request parameter mapping, one of the parameters is an api_key that takes its value from the query string

At the moment I’m hard coding the API key into the query string from the client e.g:

https://xxxx.execute-api.eu-west.amazonaws.com/mystagev1/movies?api_key=xxxxxx&language=en-GB&pageNum=1&region=GB

This works, however, is this best practice, is it possible for the key to be hosted within the API gateway, so the key is not exposed to the client?