Secondly, an API KEY, based on its privileges, can act as a private key
Stop talking nonsense. It depends on trusting your service, it's nothing like e.g. a Bitcoin private key. If you keep insisting on it you'll likely earn red trust - people tend to care about that shit on this forum.