Hello!
In my sites I use the Secret Key, normally via Google Authenticator, to add an extra level of security.
From all my tests and what I have tried so far, com_api does not accept input of the Secret Key to grant access.
This causes that users using Authenticator will not get access through com_api