my question if we host react app on github pages and put apikey in .env file it's going to work or not or any other better method of hiding api key.
Using a .env file would not work, as its purpose is to not be included in the version controlled repository. Instead, I would recommend to use a .env file while developing locally and then host it in Vercel or Netlify, which both support environment variables. With that said, you still shouldn't really be accessing APIs from your frontend, especially with API keys, and should instead be accessing them from the backend.