Hide Admin API access token from fetch requests made with Javascript in the theme files

What’s the best way to hide Admin API access token from fetch requests made with Javascript in the theme files?

Don’t make Admin API requests with JavaScript in your theme files to start with.

Make a call to an app that will correctly and properly secure access.

Use app proxies.