move API key to secrets.xcconfig so that it can be configurable