fixed api key escaping in backend