Inspecting the app's content or the network traffic.

Decompiling apps even on iOS is not too hard, typically API keys would either be in resource files or exposed via strings in the binary itself.