I Have seen alot of sample where the API key is hard coded into, unless you are building a desktop there is no need to do this. Facebook provides the API key, and the session key in the iframe url. Your application should retrieve the keys from the url, this makre your code more portable.
UPDATE – 9/10/10
With the new changes to face book app, make sure that you go into the advanced setting and check canvas session parameters.
Example of sharing a session:
fb= new Facebook();
var bytes:ByteArray = jpegencoder.encode(lastpumpyourselfbm.bitmapData);
var call:UploadPhoto = new UploadPhoto(bytes);
Designed By: Charlie Guerrero & Ryan Raulie
Developed By: Myself and co-developed with Aaron L’Heureux
Technology: PHP, Flash, jquery and XML
Berklee Valencia Homepage
Berklee Valencia Interior page
United States Distric Court