Why is an API key in an app not a secret, and how do you handle secrets?
Essence
Everything inside the app package is available to anyone who downloaded it. An .ipa is an archive: the binary can be taken apart (strings, a disassembler), Info.plist and resources read as is, and on a jailbroken device values can be intercepted right in memory at runtime (Frida and similar tools). So a key in the app isn't a secret, it's an identifier, and you have to design assuming the attacker knows it.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep