How to avoid putting authentication data in version control? – Ebay API

This question is just informal and thus I cannot provide any sort of MWE/example/…

I thought of developing a Java application to interact with the eBay API.
To do so, one has to obtain a (private) key from them to authenticate to avoid a single application disturbing the normal processes. It’s clear that putting these keys in a Git repository for example and publishing the repo was a bad idea.

On the other hand, I would like to allow others to contribute and/or use my code for their own work (classic open-source approach).

I could think of the following approaches to solve the issue:

1. Write the main code as a LGPL library and write a small application using the library plus the keys. Thus, the library can be published without problems.
2. Create a separate class that contains the keys; do not put this into the repository.
3. Add a text file outside the VCS (or ignored by it) to the project and read it at runtime from the .jar file.
4. Do some fancy stuff at compile time: somehow replace just before the real compiler runs the correct data into the source files and remove afterwards. That is wrap the compiler in a shell script or configure user defined compilation routines for the critical file.

The benefit of the first two approaches are that it is complicated to regain the key from the completed jar file (I guess, please correct me if it is easily reverse-engineerable). The downside is that any other person will not be able to compile the program. In case 1, the main method is missing; in case 2, a whole class will be referenced but nor be present.

Case 3 is a bad idea because, if you have the jar file, you can directly extract the key as text file and have it in plain text.

Case 4 is, in my own opinion, also not the best solution: messing around with source code at compile time looks quite nasty to me. Nevertheless, it was (as far as I can think of it) the best solution of these presented here.

Can you think of a better solution?
How are such problems handled correctly?

Edit:
To make things clearer:
I am not worried about the credentials of the users that are using my application.
Instead eBay requires that each program using their API authenticates itself with a key.
This way eBay can shut down singe applications if running zombie or doing illegal things (in terms of the license agreement).

These keys (the access keys for the API) need to be readable by the application (otherwise I could not authenticate with them) but these keys must not be available to anybody else.
If anybody had the keys he/she could send API calls in the name of my program and lead to my keys getting revoked.