make api key private