Just a quick note - I was having some issues with DNS last night, and the app seems to log the complete URL it's looking up, including the api_key in that case-
[ERR] Failed to fetch station 91906: Get http://data.tmsapi.com/v1.1/stations/91906?api_key=XXXXXXXX&lineupId=: dial tcp: lookup data.tmsapi.com: no such host
You can pull the api_key using strings anyway so removing it from the log doesn't prevent it leaking, but I figured I'd point it out.
Also, it may be worthwhile to switch to the https endpoint for the url.
There really isn't any CPU overhead to using ssl these days, and https://data.tmsapi.com works reliably. Not the biggest of deals, but it offers better MITM protection and privacy to use the https version.