Mask it, but:
- allow it to be revealed via a click
- include a
copy to clipboard icon next to it
Although API keys are too long to be memorable via shoulder-surfing, they are vulnerable to high-resolution video recordings or photographs (e.g., surveillance cameras or film crews who dropped by for an interview).
There are several documented instances of credentials leaking out during live TV streams: TV5Monde, the SuperBowl and the 2014 World Cup are just a two of them.
Security is a context where adding a few additional hurdles could be a good thing, because you are dealing with sensitive information. The consequences of a leak can be anywhere in the spectrum between an annoyance and a disaster, so you have to consider that when making a UI decision.
As you noted yourself, users are not expected to manually type the API keys somewhere else, they will most likely use copy/paste to transfer them elsewhere. Thus, the
copy to clipboard feature addresses that problem without compromising security.
There is little to gain from exposing API keys on the screen.