move api keys to more secure location