I got an exercise where IATA codes are involved - exercise's specification says those codes can be 2-4 letters. After a few minutes of research I see that those codes should be 3 letters, so can IATA code for an airport be more or less than 3 letters?
IATA themselves say it's a three-letter code:
Airlines and CRSs [computer reservations systems] may request the assignment of a unique three-letter code to identify an airport
The UN trade locations coding also says the same thing:
when a three-letter code is used alone to indicate a location, it designates the name of an airport or location as adopted by IATA (whose code only has three letters)
According to Wikipedia, IATA has several different types of code that can be from one to four characters, but airport codes specifically are always three based on all the sources I mentioned.