Api keys should remain private