now with improved security - hidden api keys