No obfuscation please and simpler the better.
Similar post is http://stackoverflow.com/questions/294777/shared-secret-with-api-in-an-ajax-adobe-air-app but I was not convinced that these protect from decompiling. If they do, please explain (For example, what's stopping someone from decompiling and using the URLLoader themselves).
If the public key is in your code, there is nothing that can ever stop anyone from decompiling your app and getting the key.
Also - if the key is sent unencrypted from the AIR app to the server, it is a piece of cake monitoring the net traffic and retrieving the key from there. So even if you protect the key by storing it encrypted, you're pretty much screwed.
If you want to protect it, you have to send your calls through a proxy server that you control and keep the key there.