change api key to secret