Your live API key can create payments on your Mollie account. Treat it accordingly.
The basic rules
Never email it. Not to us, not to your developer, not to anyone.
Never paste it into a support ticket. If we need to see your setup, we will ask for the System report from the plugin, which deliberately leaves your keys out.
Never put it in a shared document. Those things get forwarded.
If a key has been exposed, revoke it in your Mollie dashboard and generate a new one. It takes a minute, and then the old key is worthless to anyone who has it.
Locking the keys to your account
The plugin has a setting for this, and it is worth understanding before you use it.
On the API keys tab, at the bottom, you will find API key security, with an option called Lock API keys to my account only.
Switch it on, and only your WordPress account can view or change the API keys. Other administrators on the same site will see that the keys exist, but they will not be able to read them or edit them.
When to use it
Use it if other people have administrator access to your website. A developer, an agency, an employee, a freelancer. They have every right to be in your admin, but that does not mean they need to be able to read the key that moves your money.
You probably do not need it if you are the only administrator. It adds nothing, and it introduces the risk below.
The important warning
The plugin says this on the page, and it means it.
If your WordPress account is deleted or lost, nobody else can read or change those keys without direct access to the database.
That is not a bug. It is the entire point of the lock. But it means that if you lock the keys to an account and then that account goes away, you have a problem that only a developer with database access can solve.
So before you switch it on, ask yourself one question: is this account going to exist in two years?
If it is your own account on your own site, yes. If it is a temporary admin account you made for a project, no. Do not lock the keys to an account you are going to delete.
A sensible setup
For most people, this is the right answer.
Use your own permanent administrator account. Switch the lock on if other people have admin access. Leave it off if you are the only one.
And whatever you do, keep a copy of your keys somewhere safe outside WordPress, in a password manager. Not in a spreadsheet, and not in your email.