remove hard-coded API key