Can IATA code for an airport be more or less than 3 letters?
IATA themselves say it's a three-letter code:


  Airlines and CRSs [computer reservations systems] may request the
  assignment of a unique three-letter code to identify an airport


The UN trade locations coding also says the same thing:


  when a three-letter code is used alone to indicate a location, it
  designates the name of an airport or location as adopted by IATA
  (whose code only has three letters)


According to Wikipedia, IATA has several different types of code that can be from one to four characters, but airport codes specifically are always three based on all the sources I mentioned.