Amzir-A hiding the entire API is impossible because the Flarum single page needs it.
If extensions are correctly implemented, there shouldn't be any sensitive data in the responses, or the extension should provide a new permission so you can customize who can see what.
As for the Imgur client key, which extension are you using ? I believe FoF Upload uses it server side but if I remember correctly the other Imgur extension uses Imgur client-side API to upload images, so it requires the client key to be public. That's what a client key usually means versus private or server keys.
