hide api credentials