I Have seen alot of sample where the API key is hard coded into, unless you are building a desktop there is no need to do this. Facebook provides the API key, and the session key in the iframe url. Your application should retrieve the keys from the url, this makre your code more portable.
UPDATE – 9/10/10
With the new changes to face book app, make sure that you go into the advanced setting and check canvas session parameters.
Example of sharing a session:
fb= new Facebook();
var bytes:ByteArray = jpegencoder.encode(lastpumpyourselfbm.bitmapData);
var call:UploadPhoto = new UploadPhoto(bytes);
Note: We were tasked with creating a site that would pull in content from a&g blog, Flickr, and YouTube allowing seamless cross linking between the different sections and do it all 4 weeks. This meant writing a middle layer communications api that would query the wordpress database(standard feed from wordpress were not sufficient), Flickr and YouTube that would return simple formatted XML to be used by Flash. Content Association was done by using common naming scheme for tags accross all frameworks. This design choice gave us a decentralized way of managing content.
Allen & Gerritsen
As you view the video below remember that videos are streamed from YouTube and Images are streamed from Flickr