Protecting API keys on Capacitor Apps

[piyushnh]

As mentioned in this answer on Stackoverflow - https://stackoverflow.com/a/58882407/8466583 , Publishable API keys on capacitor apps can be protected via setting hostname to your domain and then whitelisting that domain. A potential pitfall with this approach is that anyone can deploy a capacitor android app with hostname set to the whitelisted domain, get the API Keys and send requests to the API.

Am I missing something? or is there a workaround to this?