api keys placed on process.env, variables moved lower on server to prevent undefined error