In general http referrer checks are indeed a basic means of security but not foolproof, anything sent from the client can be tampered with many available tools, including referrer spoofing and user-agent spoofing.
To better secure the API key, we will need to add layers of protection, for example, to keep the key on server side instead of leaving it in plain view at the front end. Key needs to then be retrieved via an custom API to return the key to the app whenever needed.
To make that even more secured, have the server side use the key to retrieve the necessary content before sending the content to the requesting app client, not exposing the key in the entire process. We can then add other security measures on this API end point such as limiting the accessible IP addresses and ratelimits, etc.
just my two cents worth...
Cheers,
Raymond
