You could evade Apple by allowing users to register their API key on your website, not in your app.