You need the API key to be long enough to be unguessable. Otherwise, I could get free stuff by just guessing someone else's key.

This is significantly longer than what you need to avoid a collision. The idea of having a three-character key is just crazy.