I am surprised nobody has so far mentioned using the API key in the wp-config.php file...

/** Define WordPress.com API Key */
define('WPCOM_API_KEY','c1d044646524');

That way, your client will never know.