Then you could just sniff the traffic, or if you can't MITM the connection because of pinning etc. then you could still run the app inside a debugger and get the keys that way.

Note that if the keys are valid for all users, you'd only need to do this once per service.