use environment variables, destroy old api key