Research: How to protect secrets in a `Flutter` App? 🔐

Following on from the discussion in: https://github.com/dwyl/auth/issues/277#issuecomment-1441273288
We need to understand if it's _possible_ to do "secrets" in a `Flutter` App ... 🔐 🤷‍♂️
If we are deploying a `Flutter` ***`Web`*** `App` e.g: https://dwylapp.fly.dev/
will any "secret" key that we include in it just be in the [`main.dart.js`](https://dwylapp.fly.dev/main.dart.js)
and thus readable by anyone. 💭

Opening this question as a research topic. 🔍
I would like a _definitive_ answer to this. ✅
How do ***Banks*** that need to protect an `API key` do it? 🤷‍♀️
Do they have a multi-step handshake process for sharing 🤝
a session-based one-time key with their `Flutter Web` App ⏳
instead of including the an `API key` in their "bundle" (APK)? 💭