hiding api keys in UI