replace secret by api_key