Does the API Ratelimit?

Yes the api ratelimits requests. You can do up to 10 requests within a 1 minute window.

Why use the PublicKey and not the PrivateKey?

The PrivateKey is used to verify that the request comes from the Minecraft server and not just a random person. Therefor you should never use the PrivateKey outside the plugin for whatever the reason may be.