#7 remove hardcoded API key