If you extract a key from a proprietary client to decrypt a private API, it definitely is illegal. If you do this as a corporation, it would also be easy to detect by abnormal usage patterns tied to your account and presents you as a nice big set of pockets to get sued.

Just screen scraping isn’t illegal, but is fragile as fuck and will break at the worst time and you have no ability to implement version control to manage it.