You scored some internet points.. But posting this before the company could react, smells of bad taste, and won't score you much respect.
EDIT: I'm waiting for WeWard answer. And will help them fix stuff presented in this article.
This is a shitty article that isn't humorous at all. It would've been funny if you had reported it, they had fixed and you'd posted the article after. This reads like an engineer trying to get an ego boost and a pat on the back.
Be angry at the company who clearly don’t have a clue how to secure anything.
They keys may already be public (technically), but he is the one publicizing it and posting it on Hacker News. OP is also clearly aware of how much harm can be done using these keys, since he asks people to not use them.
Legally, those API calls signify something in the real world. You are representing that the action/status signified by the API call happened in the real world. _It's one thing to accidentally or mistakenly call those APIs, but to do so deliberately if such action/status is not true is fraud.
By itself, that the API calls are fraudulent wouldn't matter. But in your case, the purpose of the fraud is financial gain: each API call earns you money. In the U.S., this would be (felony) theft by fraud, among other crimes. French laws are more complicated, and as I'm not French nor do I speak French I won't attempt to go into any detail as to what the specific crimes would be, other than to say it appears that your actions, if performed, would appear to constitute several different crimes.
[Note that in the U.S., intent matters, so fake API calls for purposes of QA testing, security testing, etc., isn't fraud...but could be a crime if performed without the website owner's permission.]
Maybe you can provide sources ?