API key security for mobile apps

I have a few API keys that are just hard coded into the app, I need some advice on what I’m supposed to do to fix that. My only current method is to have a database with users, save the users id to device, when they sign in it talks to a cloud function to make sure the user exists in the database, then it gives them an api key and it’s saved to storage.

I tried to implement that method and cloud functions are confusing, is it really a security concern in a built and packaged app when downloaded from something like the iOS App Store?

Any other methods I should be using?