How should I store my API token? It's a bad idea to hardcode in the code.