If I understand it correctly, in your use case, the user is "given a unique API key" (generated somewhere outside the keychain?). In that case, your use case is not supported by the Secure Enclave-backed keychain. As Apple's article says,
Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.
Let's say, however, you do want to use an API key generated within the Secure Enclave, then it'd have to be a 256-bit elliptic curve key, and can only be used in certain supported ways (also in the same Apple article):
Stores only 256-bit elliptic curve private keys. These keys can only be used for creating and verifying cryptographic signatures, or for elliptic curve Diffie-Hellman key exchange (and by extension, symmetric encryption).
Furthermore, no matter how such an API key is protected within the Secure Enclave, it still has a vulnerability with access control. As Apple's design relies on entitlements to control access. So only a legitimately authorised app should have the right entitlements to access its own keys. But with privilege escalation or jailbreak, entitlements can be set for other apps to access your apps keys as well. See the Keychain Dumper project for a proof of concept.