You cannot secure any secret that is public. If the HTML page sent to the client have the API keys, they are not secret anymore. Anyone can read the page and grab the key, and use it as they want.
Don't even think about encoding, obfuscating or encrypting it client-side either. The developer tools on any modern browser will let the user see the actual request, and they will just grab the keys on the request. Even if the application is a binary with encryption and anti-tamper, and uses SSL with certificate pining, a determined user will grab the keys. It can take seconds or days, but the key will leak.
To protect the keys, use a proxy. Make a server side component that holds the keys and access the backend, and your HTML page (or app, or Java, or whatever client application) will access it.
And you cannot really know if the client connecting is your client. Even MMO game producers have trouble dealing with alternative clients used to bypass some protections. You can only make it harder, but again, a determined attacker can bypass your protections.