do not log api secret