hiding api keys