Depends on the API family.

But without HTTPS, i guess that keys could be easily spoofed and stolen. Am i right?

It still depends on the API.

If it's an API that doesn't require any key to use and doesn't pass any sensitive data then there's no requirement to use HTTPS.

However for the trading, product and finder API's so far I've always found they're working fine with HTTPS.