removing api key directly from routes into config file