how to protect my JS_SECRET_KEY ?

You cannot make it totally secret, the only thing which might help a bit is to obfuscate your code.
As I said, you should not rely on making the secret key hard to find in order to secure your app. Set up correct permissions for users instead.