The API Key which is passed via
sc_apikey parameter is not any secret key. It's just and ID of a
OData Item settings item.
Now it's all up to you what you allow to read from the databases using that key.
In the most simple scenario, you only allow reading e.g. from
web database using
anynomous user credentials, so you only allow reading items which has
read access rights allowed for everyone. This data is public anyway.
You can limit the data which can be accessed with that
API key using fields on that item. I copied bullet points from https://nshackblog.wordpress.com/2018/01/07/using-the-odata-item-service-in-sitecore-9-step-by-step/ :
Database – fairly self explanatory, the Sitecore database you’re retrieving an item from.
Search Filter – we can apply search options using an OData filter format, I’ve left this as the default which will return the latest version of items.
CORS Origins – which origins are allowable? Add your required origins separated with a semicolon. As I’m testing this on Helix Base I have added the relevant origin.
AllowedControllers – you may wish to restrict this API Key to certain controllers and can list those here separated with a semicolon. I’m allowing all so have opted for the wildcard *
Impersonation User – you could leave this blank in which case Sitecore will use the default from your Sitecore.Services.AnonymousUser setting. The default is most likely sitecore\ServicesAPI but I’ve added this to the field anyway.