Yes the api ratelimits requests. You can do up to 10 requests within a 1 minute window.
Why use the PublicKey and not the PrivateKey?
The PrivateKey is used to verify that the request comes from the Minecraft server and not just a random person. Therefor you should never use the PrivateKey outside the plugin for whatever the reason may be.