Create a project, enable Maps JavaScript API (+ Geocoding API for the search box)
Create an API key, then restrict it to this site's address
A Maps key is visible in the source of any page that uses one — that's how Google's own demos work. What keeps it safe is a referrer restriction plus a quota cap, not secrecy.