attached policy to strip API key from outbound request.