How do I make a secure API call from a shortcode when a button is clicked?

In order to keep your key secret you will have to send a request via AJAX that say “gimme the mp3” to the server, let the server communicate with the service provider and return the result in the response to the AJAX request. This way at no point in time you expose any secret on the general web.