obfuscate API credentials