How to secure API keys in applications that will be distributed to clients

I am building an application that uses two legged authentication. I got an API key and API Secret, but now I am confused.

I am currently storing my api keys and secrets in a .yml file. But I would like to distribute the .app code, which will end up having the .yml file.

But the .app file will contain the .yml, file, which is bad since everyone will be able to see the API key and Secret.

How can I store the API key and Secret such that my application can access the key and secret without the users seeing it?

from How to secure API keys in applications that will be distributed to clients