Hi Bryan,
With the blocks that Airtable builds, we ask users for credentials and store it in globalConfig, which is a key-value store that’s scoped to that block installation. If API key won’t change, you could also include it directly in the Block code, which only you (or anyone with access to the source repo) can view.
Note that the credential will still be accessible by all base collaborators since the API requests are made client-side.