API parameters are currently marked as an issue when they appear to be sensitive. However, if you added an API key outside a Bubble parameter (such as in clear text in the URL or the body), they won't be detected.