I really don't know/remember that answer. All I know is that when I built the plugin I made sure that when the API Key is entered on the backend its private and the frontend it appears as *. Even if that was not the case I dont think its completely impossible - someone will show something sooner or later. I will come around back to it later.