If you find a "hack" like this on a music website, keep it to your self. If you post about it, they'll try to fix it or obscure it but who knows if some guy at soundcloud will revoke their api key first or some major label dick will initiate legal proceedings forthwith. And then you've just kicked your favorite music site in the nuts, congratulations.

By the way, if you can stream it, you can download it, on any service. One-time use streaming keys are no defense against right clicking. It's just a matter of how much patience you have to expose the underlying URL.