Better security for distributing workflow

It's better to keep api keys as environmental variables for distributing to colleague or employees.