Can't hide the API key. Will protect by domain later