No, you don't pass the key, it should be kept in secret inside the app and on your server.
For example, you want to send PlayerName and PlayerScore.
First you need generate a HashValue = HashFunction(PlayerName & PlayerScore & SecretKey).
Then you send three fields to the server: PlayerName, PlayerScore and HashValue.
On the server in php file you need to generate the same hash again, using PlayerName, PlayerScore from the request, and the key stored on the server.
If both hashes match, then you can be sure that the data was sent by your app and was not compromised.
.
I used CBHash plugin (you can find it here) to generate hashes in C3. But you'll also need the same hash function on the server side, I'm sure you can find how to do it on Stackoverflow.