How can I exclude API keys, passwords, and so on from configuration management?
You can't exclude specific keys easily from being exported.

However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g.

$config['yourmodule.settings']['smtp']['api_key'] = '24ztsgfet';


And in the UI, you just store "dummy" or any other string. Note that there's currently no indication that a value is overridden in the backend, it will however display only the value that's actually stored in config, not overrides.