Also, if services only give you a single secret key per developer, what is the alternative? Proxying all API requests through your servers might work, but only with low-volume and if the service doesn't have rate limits per IP.
Most other schemes would require cooperation from the API providers, right?
If the app uses DRM (e.g. Netflix), I would imagine that some of these laws could apply depending on the country, right?
No paid api (intended to be used by a server instead of an end-user) has rate limits per ip. If it's a free api you are either using it in a way they did not intend, or the api secret is generally not truly secret (granting you special privileges) just a way to identify developers.
As for low-volume, obviously you should have servers to handle the traffic from your app. If you aren't low-volume I'm sure you can afford more servers.
It doesn't feel like you're curious for your own sake. Why are you asking?
Also, anything is illegal somewhere. Where do you want the answer to apply to?
I'm mainly interested in answers for the US, Germany/EU, and Switzerland.