moved api key generation out of dtos