refactor to hide apikey in anon func (still not great for security but better)