I think the best solution would be to create a new QML component to handle your app and api settings.
For example, the Qt World Summit app demo that comes with the SDK uses an AppSettings.qml file.
The strings you configure this way are not publicly available when you publish the app, as you then set up the QML sources to be compiled with the app binary. For more information about publishing and protecting your source files see here: https://felgo.com/doc/vplay-publishing/
Note: The above linked AppSettings.qml is a singleton (uses pragma Singleton keyword). It thus also requires a qmldir file with a singleton entry in the same directory. A Singleton type is then available throughout the whole application. You can then e.g. access the appKey setting everywhere in your code with: