Use WP admin AJAX url to hide API key

I would break this problem in to 2 parts.

First, you could sent an Ajax request to your server, sending only the dataString variable.

Then, you can use either cURL or wp_remote_get() on the server to access the real API.

This could be the only solution, if you want to avoid playing hide and seek with hashes and writing tons of code just to make it hard for the users to find the API key.