Keep APIs secret using environment variables