don't put api keys in conf