hide api keys, look in email for file