move api key to env var