what do you think about putting the api key in an env variable so it's not in the repo?  otherwise other people might end up using this specific pusher account