hide api keys from public repo