store keys in ENV, include .env in .gitignore