The API key is required for preventing attackers from deleting audit logs that can help you investigate and recover after a hack, and allows the plugin to display statistics. The keys are free if you elect to use them. By generating an API key, Sucuri will collect and store anonymous data about your website.