One of the founders, just wanted to reply and say, yes, you are entirely right. We put up that endpoint for a separate purpose, didn't expect people to find it (underestimating people is clearly a bad strategy) and will be locking it down to require a password to create/find a apikey.

In general, the apikey doesn't actually provide very much security as is; by it's public by it's very nature as you have to put it client side and expose it to all your users. We've got HMAC and secret keys in the pipeline for next week :D