Your specific question seems to be:
Is it legal to publish the project under open source license excluding the key?
The answer is clearly: "yes".
I don even have an idea why anyone should think otherwise, but there is nothing in the open source licensing model that invalidates your use of the license if you exclude the API license key (or any other information that should be kept confidential, such as login credentials) from what you share.
It is not even considered problematic to exclude a valid API license key from the distribution of an open source project. For instance, there exist countless open source clients for web-services requiring API-keys that do this.
The standard solution is to ship the project with a dummy or no API key, and make provisions (for example during installation) for users to put in place their own, real, key.
As for making sure the key is excluded, there are many different ways to do this, depending on whether the key lives in a file of its own, or is part of some other file that is otherwise required. How to exclude it is IMHO outside the scope of this question.
(PS: My first reading of this question was that it was about whether it would be legal to include a valid key in the source code. Subsequent edits made it clear that is was really about whether it would be legal to publish the project under an open source license if the valid key where to be excluded from the source code.)