In short: No. The API functionality does exactly what it's supposed to do—it calls an API. Toddle is a frontend builder, and you should never store any secrets in the frontend, as they will be exposed. That's how the web works. The secret feature would be a microservice on the Toddle backend for developer convenience. However, in my opinion, this is only valid for proofs of concept or very simple use cases.
For a robust setup, you always need a proper backend, and calls to other services should be proxied through that backend. Otherwise, you cannot implement any authentication and authorization. Imagine you have your API set up with Toddle and a secret store. Users can call this API from their browser without seeing the secret, which seems fine. However, you cannot control which user actually makes that call, how often they are allowed to do so, and so on.
If you want to build a secure and reliable app, such functionality belongs in the backend.
.jpeg/public)