You can't really avoid it. If the API key is hardcoded in the client, it's just ...

advisory5739f2 on March 10, 2014 | parent | context | favorite | on: How not to write an API

You can't really avoid it. If the API key is hardcoded in the client, it's just a matter of time and patience until it's extracted. Never trust the client.