Usually I save the API key into Info.plist file to keep it safe and use various types of algorithm to encrypt and decrypt the request. Taking consideration of the security.