better security for API data access