API key of any downloadable application should be considered as “public”. Removing it from public source code just makes harvesting a bit harder, but it's still

API key of any downloadable application should be considered as “public”. Removing it from public source code just makes harvesting a bit harder, but it's still possible. So if API key of such applications is so important — it's just a bad service design.