use api key for deployment to heroku

fix #739