API_KEY and API_SECRET are both global and thread-local