An «API Key» value can be public, because it is used only in conjunction with the secret «Secret Key» value:
It is impossible to do anything with the iyzico API using only an «API Key» value without the corresponding «Secret Key» value.
iyzico API employs public-key cryptography, where an «API Key» is a public key, and the corresponding «Secret Key» is the private key.