alternative to storing api keys in migration yaml files?
In Drupal 8, If the migration is one that is a config entity (shows up in /config rather than in migrations/) values can be overridden in settings.php or environment specific settings.

// Set migration settings from environment variables.
$config['migrate_plus.migration.node_article']['source']['urls'] = [getenv('CMS_ARTICLE_API_URL') . '/services/articles/facilities/all'];
$config['migrate_plus.migration.node_article']['source']['headers']['apikey'] = getenv('CMS_ARTICLE_API_KEY');