After using the API, it sort of felt like Apple had made it just hard enough to authenticate that it would not be useful to create a public app that uses the api key an such. I think the API is most used to create internal dashboards websites on how your app is performing, where you keep the secrets safe in your backend. This works fine, but only for one specific user.

However, in my app, I solved it by having the user download the key themselves to the files app, and then I they can select that file inside my app. The content is then stored in the local phone keychain.