Passing API secrets to snapcrafy.yml

In my project I have a snapcraft.yml and my software need some 3rd party api keys. How I can keep them seperately from my snapcraft.yml.

In my case I want to snap the minitube and for that I need to pass around some youtube api keys.

Are these secrets required at build time? or run time?

If they are required at run time, it seems like it would be appropriate for the end user to set them as a config, possibly with snap set <snap-name> <config-key>=<secret>

On the other hand if you need them at build time, you could have a part that pulls those secrets and writes them to a config file.

These parameters are flags uses into qmake in order to build my application.

The flag I need to pass is the: qmake "DEFINES += APP_GOOGLE_API_KEY=YourAPIKeyHere" where YourAPIKeyHere is my youtube api key.

For shearability reasons I want to keep my APP_GOOGLE_API_KEY secret.