IBM Cloud Functions - Securing API keys and Passwords inside the function

Question

I got some Node.js code in an IBM Cloud Function. I have enabled it as a web action and the function is called via webhook from Watson Assistant.

Is it safe to have my AP