API keys and secrest should be made configurable using environment variables. See for example lib/flickr.js.