Calling PHP wrapper on client side

I´m currently working on a school project, where we are using Apache cordova (HTML, CSS and JS side) and currently our school has a server, where our .php file is located.

In our project, (one of the HTML files) we use API key and an domain address, that we want to get rid off from source code (so other students cant see it). What would be easiest way to execute this?

We´ve been thinking following;

We use the php-file as a wrapper with the following code;

IE.

<?php
function getJson($data){

    $decoded = json_decode($data);
    if (isset($decoded)){

        // Toteutusten haku
        $url = "URL THAT WE DONT WANT TO BE SEEN";
        $apiKey = "API KEY GOES HERE";

        // curl
        $ch = curl_init($url);
        // curl_exec returnsanswer (not boolean)
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        // Asets api key, ":"
        curl_setopt($ch, CURLOPT_USERPWD, $apiKey.":");

        // Setting message - JSON
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

        // Sets false if necessary
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

        // Sends request
        $responseJson = curl_exec($ch);
        return $responseJson;
        curl_close($ch); //close session
    **}
}
?>

And in HTML file we have code snippets that looks like following;

// B building rooms
            if (buildingcode.startsWith("B", 5)) {
                var requestB = new XMLHttpRequest();
                requestB.onreadystatechange = function () {
                    if (requestB.readyState === 4) {
                        if (requestB.status === 200) {
                            try {
                                var jsonB = JSON.parse(requestB.responseText);
                                for (var fb = 0; fb < jsonB.resources.length; fb++) {
                                    var resB = jsonB.resources[fb];

                                    if (resB.type === "room") {
                                        if (bTilat.indexOf("code")) {
                                            bTilat.push(resB.code + resB.name.slice(resB.name.indexOf(' ('), 50));
                                        }
                                    }
                                }
                            } catch (e) {
                                console.log(e.message);
                                return;
                            }
                        }
                    }
                    //console.log(bTilat);
                };
                requestB.open("GET", 'THIS PART HAS THE DOMAIN WE WANT TO HIDE', true, "THIS PART HAS THE API WE WANT TO HIDE", "");
                requestB.send(null);
            }

So my question is following; I guess we need to get rid off

requestB.open("GET", 'THIS PART HAS THE DOMAIN WE WANT TO HIDE', true, "THIS PART HAS THE API WE WANT TO HIDE", "");
                    requestB.send(null);

From html, but how do we request the code from wrapper?

Thank you in advance.