moved api key to client