REST API allows to get or change any information in your store (including profiles, orders, payment transactions, inner store configuration, products, categories and so on), so your API key must be as complex as possible and kept private.