add separate secure external api config, and use it for oauth