You should externalize all sensitive information into a dedicated property file. This file should be excluded from source control. Most (if not all) source control systems will allow you to mark a file as not to be versionned. I dont know specifically about Hg, but .hgignore seems to be the place.
All source control systems are particularly annoying when it comes to removing informations from the repository. We could almost think that they were created to record the full history of a project ;-) So be ready to change your API key once it gets commited by mistake (not that I have ever done something like this).
Edit as it seems I wasnt clear enough :
The most important part is to clearly separate the sensitive information from the standard informations. You should have one file that contains sensitive and only sensitive information. Then tag this file as "not versioned". If you dont, you will invariably end up commiting your sensitive informations. And once they are out, there is almost no way to make them disapear.
One other way is to encrypt sensitive data, commit the encrypted data and have the decryption key only present on the server (or on some other carefully controlled location, far from your version control system). We actually use this solution in the private bank where I work, so that the developers dont have access to the passwords of the production systems.