Probably should still funnel all front-end requests to your back-end first, then use the appropriate api_key for the user and have the back-end make the api call to discourse.
If you do want to keep in all on the front-end, I would generate a new discourse_api key every time the user logs in to your app. You will also have to setup CORS on discourse to accept the requests from your front-end.
You could also implement SSO (single-sign-on) so your users could just use discourse directly without having to login again.