You should definitely delete your API key and have a README.md
in the github Repository that states that the pre-requisite is to obtain an API key and place it in the config. This is assuming your code reads the API key from a config file. If it doesn't, update your code to do so.
I don't think this is an unreasonable request. Also, if you do leave your API key in there, very quickly your key will hit the API rate limit and WolframAlpha will likely disable your key anyways. HTH.