Fix how API keys are accessed

Default to process.env rather than config.