When you say browser based do you mean a game written in HTML/JavaScript?
I suppose you could obfuscate your secret code a bit to prevent people easily using it.
I'm not too sure about environmental variables though sorry.
Yeah, I do mean that - right now anyone can go to my game's page, open the developer tools and look at the source code.
Obfuscating the code seems like the best option, thanks.